Improper Access Control - CVE-2018-2612

Vulnerability identifier: #VU10265

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-2612

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability exists due to an unspecified error in the MySQL Server. A remote privileged user can exploit the vulnerability to modify or delete certain data in database.

Amazon Linux AMI
Gentoo Linux
SUSE Linux
Slackware Linux
Ubuntu
Fedora
Opensuse
Red Hat Software Collections
mariadb (Alpine package)
community-mysql
rh-mysql57-mysql (Red Hat package)
mariadb

Install updates from vednor's website.

mariadb (Alpine package) - update to 10.1.32-r0
community-mysql - addressed in versions 5.7.21-1.fc27, 5.7.21-6.fc26
rh-mysql57-mysql (Red Hat package) - addressed in versions 5.7.21-2.el6.1, 5.7.21-2.el7.1
mariadb - addressed in versions 10.1.32-1.fc26, 10.2.13-1.fc27, 10.2.13-2.fc27, 10.2.13-2.fc28

• http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

• Multiple vulnerabilities in Oracle MySQL Server
• Ubuntu update for MySQL
• Slackware Linux update for mariadb
• Amazon Linux AMI update for mysql55, mysql56, mysql57
• OpenSUSE Linux update for mysql-community-server
• SUSE Linux update for mariadb
• SUSE Linux update for mariadb
• OpenSUSE Linux update for mariadb
• Red Hat update for mysql
• Gentoo update for MySQL
• Improper Access Control in mariadb (Alpine package)
• Red Hat Software Collections update for rh-mysql57-mysql
• Fedora 27 update for community-mysql
• Fedora 26 update for community-mysql
• Fedora 27 update for mariadb
• Fedora 28 update for mariadb
• Fedora 27 update for mariadb
• Fedora 26 update for mariadb