Improper Access Control - CVE-2017-3651

Vulnerability identifier: #VU10300

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-3651

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability exists due to an unspecified error in the MySQL Server within Client mysqldump component. A remote authenticated attacker can exploit the vulnerability to perform unauthorized modification of data.

Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
Ubuntu
Fedora
Percona Server for MySQL
mysql-5.5 (Debian package)
community-mysql

Install updates from vednor's website.

mysql-5.5 (Debian package) - addressed in versions 5.5.57-0+deb7u1, 5.5.57-0+deb8u1
community-mysql - addressed in versions 5.7.19-1.fc24, 5.7.19-1.fc25, 5.7.19-1.fc26

• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

• Multiple vulnerabilities in Oracle MySQL Server
• Ubuntu update for MySQL
• Multiple vulnerabilities in Percona Server for MySQL
• Ubuntu update for MySQL
• Debian update for mysql-5.5
• Amazon Linux AMI update for mysql55
• Amazon Linux AMI update for mysql56
• Ubuntu update for MySQL
• Gentoo update for MySQL
• Red Hat update for mariadb
• Fedora 26 update for community-mysql
• Fedora 24 update for community-mysql
• Fedora 25 update for community-mysql