Improper Access Control - CVE-2017-3653

Vulnerability identifier: #VU10303

CSH Severity: Low

CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-3653

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability exists due to an unspecified error in the MySQL Server within DDL component. A remote authenticated attacker can exploit the vulnerability to perform unauthorized modification of data.

Gentoo Linux
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
Ubuntu
Slackware Linux
Fedora
Percona Server for MySQL
mysql-5.5 (Debian package)
mariadb (Alpine package)
community-mysql

Install updates from vednor's website.

mysql-5.5 (Debian package) - addressed in versions 5.5.57-0+deb7u1, 5.5.57-0+deb8u1
mariadb (Alpine package) - update to 10.1.26-r0
community-mysql - addressed in versions 5.7.19-1.fc24, 5.7.19-1.fc25, 5.7.19-1.fc26

• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

• Multiple vulnerabilities in Oracle MySQL Server
• Ubuntu update for MySQL
• Multiple vulnerabilities in Percona Server for MySQL
• Ubuntu update for MySQL
• Debian update for mariadb-10.1
• Debian update for mysql-5.5
• Slackware Linux update for mariadb
• Amazon Linux AMI update for mysql55
• Amazon Linux AMI update for mysql56
• Ubuntu update for MySQL
• Debian update for mariadb-10.0
• Gentoo update for MySQL
• Red Hat update for mariadb
• Improper Access Control in mariadb (Alpine package)
• Fedora 26 update for community-mysql
• Fedora 24 update for community-mysql
• Fedora 25 update for community-mysql