Improper Access Control - CVE-2017-3641

Vulnerability identifier: #VU10290

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-3641

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability exists due to an unspecified error in the MySQL Server within DML component. A remote privileged user can exploit the vulnerability to perform a denial of service attack.

Amazon Linux AMI
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
Ubuntu
Slackware Linux
Fedora
Percona Server for MySQL
mariadb (Alpine package)
mysql-5.5 (Debian package)
community-mysql

Install updates from vednor's website.

mariadb (Alpine package) - update to 10.1.26-r0
mysql-5.5 (Debian package) - addressed in versions 5.5.57-0+deb7u1, 5.5.57-0+deb8u1
community-mysql - addressed in versions 5.7.19-1.fc24, 5.7.19-1.fc25, 5.7.19-1.fc26

• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

• Multiple vulnerabilities in Oracle MySQL Server
• Ubuntu update for MySQL
• Multiple vulnerabilities in Percona Server for MySQL
• Ubuntu update for MySQL
• Debian update for mariadb-10.1
• Debian update for mysql-5.5
• Slackware Linux update for mariadb
• Amazon Linux AMI update for mysql55
• Amazon Linux AMI update for mysql56
• Ubuntu update for MySQL
• Debian update for mariadb-10.0
• Gentoo update for MySQL
• Red Hat update for mariadb
• Improper Access Control in mariadb (Alpine package)
• Fedora 26 update for community-mysql
• Fedora 24 update for community-mysql
• Fedora 25 update for community-mysql