Improper Access Control - CVE-2017-3636

Vulnerability identifier: #VU10285

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-3636

CWE-ID: CWE-284

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability exists due to an unspecified error in the MySQL Server within Client programs component. A local user can exploit the vulnerability to gain full access to MySQL databases.

Gentoo Linux
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
Ubuntu
Slackware Linux
Fedora
Percona Server for MySQL
mysql-5.5 (Debian package)
mariadb (Alpine package)
community-mysql

Install updates from vednor's website.

mysql-5.5 (Debian package) - addressed in versions 5.5.57-0+deb7u1, 5.5.57-0+deb8u1
mariadb (Alpine package) - update to 10.1.26-r0
community-mysql - addressed in versions 5.7.19-1.fc24, 5.7.19-1.fc25, 5.7.19-1.fc26

• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

• Multiple vulnerabilities in Oracle MySQL Server
• Ubuntu update for MySQL
• Multiple vulnerabilities in Percona Server for MySQL
• Ubuntu update for MySQL
• Debian update for mariadb-10.1
• Debian update for mysql-5.5
• Slackware Linux update for mariadb
• Amazon Linux AMI update for mysql55
• Ubuntu update for MySQL
• Debian update for mariadb-10.0
• Gentoo update for MySQL
• Red Hat update for mariadb
• Improper Access Control in mariadb (Alpine package)
• Fedora 26 update for community-mysql
• Fedora 24 update for community-mysql
• Fedora 25 update for community-mysql