Improper Access Control - CVE-2017-3636

Vulnerability identifier: #VU10285

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-3636

CWE-ID: CWE-284

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability exists due to an unspecified error in the MySQL Server within Client programs component. A local user can exploit the vulnerability to gain full access to MySQL databases.

Amazon Linux AMI
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
Ubuntu
Slackware Linux
Fedora
Percona Server for MySQL
mariadb (Alpine package)
mysql-5.5 (Debian package)
community-mysql

Install updates from vednor's website.

mariadb (Alpine package) - update to 10.1.26-r0
mysql-5.5 (Debian package) - addressed in versions 5.5.57-0+deb7u1, 5.5.57-0+deb8u1
community-mysql - addressed in versions 5.7.19-1.fc24, 5.7.19-1.fc25, 5.7.19-1.fc26

• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

• Multiple vulnerabilities in Oracle MySQL Server
• Ubuntu update for MySQL
• Multiple vulnerabilities in Percona Server for MySQL
• Ubuntu update for MySQL
• Debian update for mariadb-10.1
• Debian update for mysql-5.5
• Slackware Linux update for mariadb
• Amazon Linux AMI update for mysql55
• Ubuntu update for MySQL
• Debian update for mariadb-10.0
• Gentoo update for MySQL
• Red Hat update for mariadb
• Improper Access Control in mariadb (Alpine package)
• Fedora 26 update for community-mysql
• Fedora 24 update for community-mysql
• Fedora 25 update for community-mysql