Denial of service - CVE-2017-10167
Published: October 31, 2017
Vulnerability identifier: #VU8992
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-10167
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote low-privileged attacker to cause DoS condition on the target system.
The weakness exists due to an error in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). A remote attacker can use multiple protocols to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Successful exploitation of the vulnerability results in denial of service.
The weakness exists due to an error in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). A remote attacker can use multiple protocols to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Successful exploitation of the vulnerability results in denial of service.
Affected software
Percona Server for MySQL
Ubuntu
rh-mysql57-mysql (Red Hat package)
How to mitigate CVE-2017-10167
Install update from vendor's website.
rh-mysql57-mysql (Red Hat package) - addressed in versions 5.7.20-1.el6, 5.7.20-1.el7