Cloudanix VulnDB

CVE-2016-8318

Medium · 6.8

CVSS

6.8

EPSS

1.3%

Published

Jan 27, 2017

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in older database server software lets an attacker with limited access crash the service when someone else interacts with it, causing outages until administrators restart it.

Exploitation
Requires User Interaction
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Low-privileged network attacker can trigger a hang or repeatable crash in the MySQL Server encryption handling code when another user performs a required interaction, resulting in denial of service.

Why it matters to the business

Database service interruptions can halt application operations, cause unplanned downtime, and require administrative recovery effort, especially in environments still running the affected older releases.

How an attack unfolds

An attacker with valid low-privilege credentials connects over supported protocols and sends specially crafted requests that rely on a separate user interaction to trigger the flaw in the encryption subcomponent, leading to server instability.

How to fix it

Upgrade all MySQL Server instances to releases later than 5.6.34 and 5.7.16. Apply the latest vendor security updates as soon as they become available and verify the running version after deployment.

How to confirm the fix worked

Confirm the installed MySQL version is newer than the affected releases, review release notes for the security fix, and test that crafted requests no longer cause crashes under equivalent conditions.

Typical attack path

  1. Obtain low-privilege network credentials for the MySQL instance
  2. Establish a connection using one of the supported protocols
  3. Craft and transmit requests that exercise the vulnerable encryption path
  4. Wait for or induce the required human interaction from another user
  5. Observe repeated server hang or crash conditions

How to detect it

Review MySQL error logs and operating-system crash dumps for repeated abrupt terminations or hangs around the encryption code paths; correlate with network connection records from low-privilege accounts.

What your security team should do

  • Prioritize patching internet-facing or multi-tenant MySQL deployments first
  • Restrict network access to the database to only trusted clients
  • Monitor for availability alerts and unexpected restarts on affected instances
  • Plan upgrade testing in non-production environments before broad rollout

The record

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.6.34 and earlier and 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 6.8 (Availability impacts).

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:14.04:LTS mysql-5.5 0 5.5.54-0ubuntu0.14.04.1
Ubuntu:16.04:LTS mysql-5.7 0 5.7.17-0ubuntu0.16.04.1
Ubuntu:16.04:LTS percona-server-5.6 0 No fix
Ubuntu:16.04:LTS percona-xtradb-cluster-5.6 0 No fix
Ubuntu:Pro:16.04:LTS percona-server-5.6 0 No fix
Ubuntu:Pro:16.04:LTS percona-xtradb-cluster-5.6 0 No fix

Related vulnerabilities