CVE-2016-6662 - Researcher disclosed a critical MySQL Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-6662 | Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15. NVD description · AI analysis pending | 9.8 | 68% | PoC |
| — | |
| CVE-2016-6663 | Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17 allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table. NVD description · AI analysis pending | 7.0 | 4% | PoC ×2 |
| — |
Full article473 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 13, 2016
A security researcher disclosed a critical MySQL zero-day affecting all the default configuration of all MySQL versions including 5.5, 5.6 and 5.7.
The security researcher Dawid Golunski has disclosed a critical zero-day vulnerability affecting the popular database management system (RDBMS) MySQL. The researcher decided to disclose the critical flaw because Oracle failed to release a patch after more than 40 days the researcher reported the zero-day.
Researcher Dawid Golunski discovered several security issues in the MySQL DBMS, including a vulnerability flaw (CVE-2016-6662) that can be exploited by a remote attacker to inject malicious settings into my.cnf configuration files. The flaw can be triggered to fully compromise the DBMS by executing arbitrary code with root privileges on the server running the vulnerable MySQL instance.
The CVE-2016-6662 vulnerability can be exploited if the attacker has an authenticated connection to the MySQL service, for example in shared hosting environments, by triggering an SQL injection flaw, or through a common type of vulnerability in web services leveraging the popular DBMS.
“This advisory focuses on a critical vulnerability with a CVEID of CVE-2016-6662 which can allow attackers to (remotely) inject malicious settings into MySQL configuration files (my.cnf) leading to critical consequences.” reads the Golunski’s advisory.
“The vulnerability affects all MySQL servers in default configuration in all version branches (5.7, 5.6, and 5.5) including the latest versions, and could be exploited by both local and remote attackers. Both the authenticated access to MySQL database (via network connection or web interfaces such as phpMyAdmin) and SQL Injection could be used as exploitation vectors.”
The advisory also includes a Proof-Of-Concept MySQL exploit which demonstrates how to trigger the flaw to Remote execute code with root privileges. The researcher avoided to disclose some parts to prevent widespread abuse.
The researcher also disclosed a second vulnerability, tracked as CVE-2016-6663, that could allow the exploitation of the MySQL zero-day even by low-privileged attackers.
The attack works against the default configuration of all MySQL versions, including 5.5, 5.6 and 5.7. The MySQL zero-day vulnerability also affected the MariaDB and PerconaDB databases that were patched by their vendors by the end of 30th of August.
Golunski disclosed the MySQL zero-day because the patches released by PerconaDB and MariaDB developers were made available in public repositories, potentially allowing threat actors to exploit them in the wild.
Only we can do it sit and wait for Oracle releases patches. The researchers also suggested some temporary workarounds to mitigate the threat.
“As temporary mitigations, users should ensure that no MySQL config files are owned by MySQL users, and create root-owned dummy my.cnf files that are not in use,” explained the expert. “These are by no means a complete solution and users should apply official vendor patches as soon as they become available.”
[adrotate banner=”9″]
(Security Affairs – MySQL zero-day, hacking)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/51208/hacking/cve-2016-6662-mysql-zero-day.html