Denial of service - CVE-2017-10286

Vulnerability identifier: #VU9001

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-10286

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote high-privileged attacker to cause DoS condition on the target system.

The weakness exists due to an error in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). A remote attacker can use multiple protocols to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Successful exploitation of the vulnerability results in denial of service.

Gentoo Linux
Amazon Linux AMI
Ubuntu
Fedora
Opensuse
Percona Server for MySQL
rh-mysql56-mysql (Red Hat package)
rh-mysql57-mysql (Red Hat package)
community-mysql

Install update from vendor's website.

rh-mysql56-mysql (Red Hat package) - addressed in versions 5.6.38-1.el6, 5.6.38-1.el7
rh-mysql57-mysql (Red Hat package) - addressed in versions 5.7.20-1.el6, 5.7.20-1.el7
community-mysql - addressed in versions 5.7.20-1.fc25, 5.7.20-1.fc26, 5.7.20-1.fc27

• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

• Ubuntu update for MySQL
• Multiple vulnerabilities in Oracle MySQL
• Amazon Linux AMI update for mysql56, mysql57
• OpenSUSE Linux update for mysql-community-server
• Multiple vulnerabilities in Percona Server for MySQL
• Gentoo update for MySQL
• Fedora 26 update for community-mysql
• Fedora 25 update for community-mysql
• Fedora 27 update for community-mysql
• Red Hat Software Collections update for rh-mysql56-mysql
• Red Hat Software Collections update for rh-mysql57-mysql