Denial of service - CVE-2017-10378
Published: October 31, 2017
Vulnerability identifier: #VU9009
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-10378
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote low-privileged attacker to cause DoS condition on the target system.
The weakness exists due to an error in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). A remote attacker can use multiple protocols to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Successful exploitation of the vulnerability results in denial of service.
The weakness exists due to an error in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). A remote attacker can use multiple protocols to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Successful exploitation of the vulnerability results in denial of service.
Affected software
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
SUSE Linux
Ubuntu
Slackware Linux
Fedora
Opensuse
mysql-5.5 (Debian package)
mariadb (Alpine package)
rh-mysql56-mysql (Red Hat package)
rh-mysql57-mysql (Red Hat package)
community-mysql
Percona Server for MySQL
How to mitigate CVE-2017-10378
Install update from vendor's website.
mysql-5.5 (Debian package) - addressed in versions 5.5.58-0+deb7u1, 5.5.58-0+deb8u1
mariadb (Alpine package) - update to 10.1.32-r0
rh-mysql56-mysql (Red Hat package) - addressed in versions 5.6.38-1.el6, 5.6.38-1.el7
rh-mysql57-mysql (Red Hat package) - addressed in versions 5.7.20-1.el6, 5.7.20-1.el7
community-mysql - addressed in versions 5.7.20-1.fc25, 5.7.20-1.fc26, 5.7.20-1.fc27
mariadb (Alpine package) - update to 10.1.32-r0
rh-mysql56-mysql (Red Hat package) - addressed in versions 5.6.38-1.el6, 5.6.38-1.el7
rh-mysql57-mysql (Red Hat package) - addressed in versions 5.7.20-1.el6, 5.7.20-1.el7
community-mysql - addressed in versions 5.7.20-1.fc25, 5.7.20-1.fc26, 5.7.20-1.fc27
External References
Related Security Bulletins
- Ubuntu update for MySQL
- Ubuntu update for MySQL
- Debian update for mysql-5.5
- Multiple vulnerabilities in Oracle MySQL
- Slackware Linux update for mariadb
- SUSE Linux update for mysql
- Amazon Linux AMI update for mysql56, mysql57
- Amazon Linux AMI update for mysql55
- OpenSUSE Linux update for mysql-community-server
- SUSE Linux update for mariadb
- Multiple vulnerabilities in Percona Server for MySQL
- Gentoo update for MySQL
- Red Hat update for mariadb
- Denial of service in mariadb (Alpine package)
- Fedora 26 update for community-mysql
- Fedora 25 update for community-mysql
- Fedora 27 update for community-mysql
- Red Hat Software Collections update for rh-mysql56-mysql
- Red Hat Software Collections update for rh-mysql57-mysql