CVE-2017-3599
High · 7.5CVSS
7.5
EPSS
89.9%
Published
Apr 24, 2017
CISA due date
—
The record
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Auth). Supported versions that are affected are 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). NOTE: the previous information is from the April 2017 CPU. Oracle has not commented on third-party claims that this issue is an integer overflow in sql/auth/sql_authentication.cc which allows remote attackers to cause a denial of service via a crafted authentication packet.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Red Hat:rhel_software_collections:2::el6 | rh-mysql56-mysql | 0 | 0:5.6.37-5.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-mysql56-mysql-bench | 0 | 0:5.6.37-5.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-mysql56-mysql-common | 0 | 0:5.6.37-5.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-mysql56-mysql-config | 0 | 0:5.6.37-5.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-mysql56-mysql-debuginfo | 0 | 0:5.6.37-5.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-mysql56-mysql-devel | 0 | 0:5.6.37-5.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-mysql56-mysql-errmsg | 0 | 0:5.6.37-5.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-mysql56-mysql-server | 0 | 0:5.6.37-5.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-mysql56-mysql-test | 0 | 0:5.6.37-5.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-mysql57-mysql | 0 | 0:5.7.19-6.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-mysql57-mysql-common | 0 | 0:5.7.19-6.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-mysql57-mysql-config | 0 | 0:5.7.19-6.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-mysql57-mysql-debuginfo | 0 | 0:5.7.19-6.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-mysql57-mysql-devel | 0 | 0:5.7.19-6.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-mysql57-mysql-errmsg | 0 | 0:5.7.19-6.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-mysql57-mysql-server | 0 | 0:5.7.19-6.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-mysql57-mysql-test | 0 | 0:5.7.19-6.el6 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql56-mysql | 0 | 0:5.6.37-5.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql56-mysql-bench | 0 | 0:5.6.37-5.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql56-mysql-common | 0 | 0:5.6.37-5.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql56-mysql-config | 0 | 0:5.6.37-5.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql56-mysql-debuginfo | 0 | 0:5.6.37-5.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql56-mysql-devel | 0 | 0:5.6.37-5.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql56-mysql-errmsg | 0 | 0:5.6.37-5.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql56-mysql-server | 0 | 0:5.6.37-5.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql56-mysql-test | 0 | 0:5.6.37-5.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql57-mysql | 0 | 0:5.7.19-6.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql57-mysql-common | 0 | 0:5.7.19-6.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql57-mysql-config | 0 | 0:5.7.19-6.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql57-mysql-debuginfo | 0 | 0:5.7.19-6.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql57-mysql-devel | 0 | 0:5.7.19-6.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql57-mysql-errmsg | 0 | 0:5.7.19-6.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql57-mysql-server | 0 | 0:5.7.19-6.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-mysql57-mysql-test | 0 | 0:5.7.19-6.el7 |
| Ubuntu:14.04:LTS | mysql-5.5 | 0 | 5.5.55-0ubuntu0.14.04.1 |
| Ubuntu:16.04:LTS | mysql-5.7 | 0 | 5.7.18-0ubuntu0.16.04.1 |
| Ubuntu:16.04:LTS | percona-server-5.6 | 0 | No fix |
| Ubuntu:16.04:LTS | percona-xtradb-cluster-5.6 | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | percona-server-5.6 | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | percona-xtradb-cluster-5.6 | 0 | No fix |
Related vulnerabilities
- CVE-2017-3302 Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and… Also affects rh-mysql56-mysql
- CVE-2016-6662 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… Also affects rh-mysql56-mysql
- CVE-2016-3521 Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and… Also affects rh-mysql56-mysql
- CVE-2016-0639 Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier… Also affects rh-mysql56-mysql
- CVE-2016-0503 Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote… Also affects rh-mysql56-mysql
- CVE-2015-4870 Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and… Also affects rh-mysql56-mysql
- CVE-2015-2582 Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and… Also affects rh-mysql56-mysql
- CVE-2017-3529 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: UDF). Also affects rh-mysql57-mysql