Information disclosure - CVE-2017-10268

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU8995

Information disclosure - CVE-2017-10268

Published: October 31, 2017


Vulnerability identifier: #VU8995
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-10268
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local high-privileged attacker to obtain potentially sensitive information on the target system.

The weakness exists due to an error in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). A local attacker can gain unauthorized access to critical data or complete access to all MySQL Server accessible data.

Successful exploitation of the vulnerability results in information disclosure.

Affected software


Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
SUSE Linux
Ubuntu
Slackware Linux
Fedora
Opensuse
mysql-5.5 (Debian package)
mariadb (Alpine package)
rh-mysql56-mysql (Red Hat package)
rh-mysql57-mysql (Red Hat package)
community-mysql
Percona Server for MySQL

How to mitigate CVE-2017-10268

Install update from vendor's website.

mysql-5.5 (Debian package) - addressed in versions 5.5.58-0+deb7u1, 5.5.58-0+deb8u1
mariadb (Alpine package) - update to 10.1.32-r0
rh-mysql56-mysql (Red Hat package) - addressed in versions 5.6.38-1.el6, 5.6.38-1.el7
rh-mysql57-mysql (Red Hat package) - addressed in versions 5.7.20-1.el6, 5.7.20-1.el7
community-mysql - addressed in versions 5.7.20-1.fc25, 5.7.20-1.fc26, 5.7.20-1.fc27

External References

Related Security Bulletins