Critical vulnerability discovered in MySQL application

A researcher has discovered a critical security flaw in the world's most widely used open-source database application — one that could allow hackers to completely take over a web server.

A researcher has discovered a critical security flaw in the world’s most widely used open-source database application — one that could allow hackers to completely take over a web server.

And, because Oracle is dragging its feet in releasing a patch and word of the flaw was starting to leak out, the researcher — Dawid Golunski — went ahead Tuesday and published details of the vulnerability and a partial proof of concept.

The vulnerability affects every version of Oracle’s MySQL application and two clones of it — MariaDB and PerconaDB.

The vulnerability, designated CVE-2016-6662, could potentially allow an attacker “to execute arbitrary code with root privileges which would then allow them to fully compromise the server on which an affected version of MySQL is running,” wrote Golunski in a post laying out details of his discovery.

He said the vulnerability could be exploited locally or remotely, via SQL injection.

He said that — in line with responsible disclosure best practice — he privately told Oracle and the manufacturers of PerconaDB and MariaDB about the vulnerability on July 29.

PerconaDB and MariaDB were both patched by their vendors on August 30, he said, but “Official patches for the vulnerability are not available at this time for Oracle MySQL server.”

Because the documentation accompanying the patches for PerconaDB and MariaDB contained details that could enable hackers to reverse-engineer the vulnerability, and because over 40 days had elapsed, Golunski said he made the decision to release details of the vulnerability and limited proof-of-concept code “to inform users about the risks” before Oracle’s next update — not scheduled until next month.

Oracle declined to comment.

On one security forum there were some expressions of skepticism about the seriousness of the vulnerability, given that the hacker trying to make use of it would require certain kinds of system privileges.

“This doesn’t seem very threatening at all,” wrote one user, “If you’re not already running services with strict file permissions this is the least of your worries.”

The user added that the vulnerability was better described as privilege escalation, a lesser kind of security flaw, rather than remote code execution.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure