Improper Access Control - CVE-2017-3635
Published: July 1, 2017 / Updated: January 29, 2018
Vulnerability identifier: #VU10284
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-3635
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability exists due to an unspecified error in the MySQL Server within C API component. A remote authenticated attacker can exploit the vulnerability to perform a denial of service attack.
Affected software
Gentoo Linux
Amazon Linux AMI
Ubuntu
Fedora
Percona Server for MySQL
mysql-5.5 (Debian package)
community-mysql
How to mitigate CVE-2017-3635
Install updates from vednor's website.
mysql-5.5 (Debian package) - addressed in versions 5.5.57-0+deb7u1, 5.5.57-0+deb8u1
community-mysql - addressed in versions 5.7.19-1.fc24, 5.7.19-1.fc25, 5.7.19-1.fc26
community-mysql - addressed in versions 5.7.19-1.fc24, 5.7.19-1.fc25, 5.7.19-1.fc26
External References
Related Security Bulletins
- Multiple vulnerabilities in Oracle MySQL Server
- Ubuntu update for MySQL
- Multiple vulnerabilities in Percona Server for MySQL
- Ubuntu update for MySQL
- Debian update for mysql-5.5
- Amazon Linux AMI update for mysql55
- Amazon Linux AMI update for mysql56
- Ubuntu update for MySQL
- Gentoo update for MySQL
- Fedora 26 update for community-mysql
- Fedora 24 update for community-mysql
- Fedora 25 update for community-mysql