CVE-2017-3529

What it actually does

Low-privileged network attacker can trigger a flaw in the Server: UDF subcomponent to cause a hang or repeatable crash, resulting in denial of service.

Why it matters to the business

Database services become unavailable, causing application outages and potential data access disruption until the server is restarted.

How an attack unfolds

An attacker with low privileges connects to the MySQL server over the network and supplies crafted input to a user-defined function that triggers the vulnerability, leading to a crash.

How to fix it

Upgrade Oracle MySQL to a version later than 5.7.18 that contains the fix for the Server: UDF component.

How to confirm the fix worked

Verify the running MySQL version is newer than 5.7.18 and confirm the Server: UDF subcomponent no longer allows the crash condition under equivalent low-privileged network access.

Typical attack path

1. Obtain low-privileged network credentials for the MySQL server
2. Connect using one of the supported protocols
3. Invoke or manipulate a user-defined function with malicious input
4. Trigger the flaw causing the server process to hang or terminate

How to detect it

Examine MySQL error logs and operating system logs for repeated server crashes or hangs originating from UDF calls; correlate with authentication events from low-privileged accounts.

What your security team should do

• Apply the vendor patch to all affected MySQL instances immediately
• Restrict network access to the MySQL service to trusted sources only
• Review and limit privileges granted to database users
• Monitor for unexpected MySQL process restarts or crashes