Information disclosure - CVE-2017-10379

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU9010

Information disclosure - CVE-2017-10379

Published: October 31, 2017


Vulnerability identifier: #VU9010
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-10379
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote low-privileged attacker to obtain potentially sensitive information on the target system.

The weakness exists due to an error in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). A remote attacker can gain unauthorized access to critical data or complete access to all MySQL Server accessible data.

Successful exploitation of the vulnerability results in information disclosure.

Affected software


Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
SUSE Linux
Ubuntu
Fedora
Opensuse
mysql-5.5 (Debian package)
rh-mysql56-mysql (Red Hat package)
rh-mysql57-mysql (Red Hat package)
community-mysql
Percona Server for MySQL

How to mitigate CVE-2017-10379

Install update from vendor's website.

mysql-5.5 (Debian package) - addressed in versions 5.5.58-0+deb7u1, 5.5.58-0+deb8u1
rh-mysql56-mysql (Red Hat package) - addressed in versions 5.6.38-1.el6, 5.6.38-1.el7
rh-mysql57-mysql (Red Hat package) - addressed in versions 5.7.20-1.el6, 5.7.20-1.el7
community-mysql - addressed in versions 5.7.20-1.fc25, 5.7.20-1.fc26, 5.7.20-1.fc27

External References

Related Security Bulletins