Is CVE-2017-3251 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-3251 being exploited in the wild.

How severe is CVE-2017-3251?

Medium severity, with a CVSS score of 4.9, published 27 January 2017.

Which products and versions are affected?

Oracle MySQL Server 5.7.16 and earlier.

Is there a fix for CVE-2017-3251?

A patch was published on 2017-10-12: Red Hat released updates for rh-mysql57-mysql (5.7.19) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-3251 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2017-3251?

Check whether you run Oracle Mysql or Oracle MySQL Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-3251: Oracle MySQL Server denial of service in Optimizer

CVE-2017-3251 · Severity: medium · CVSS 4.9 · Published 2017-01-27

A vulnerability in the Optimizer component of Oracle MySQL Server allows a high-privileged user to remotely crash the database. This can lead to a complete denial of service, impacting business operations that rely on the database's availability. Successful exploitation results in a server hang or a repeatable crash, requiring administrative intervention to restore service.

Technologies: Oracle Mysql, Oracle MySQL Server. Vendors: Oracle.

Quick answers

Is CVE-2017-3251 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-3251 being exploited in the wild.
How severe is CVE-2017-3251?: Medium severity, with a CVSS score of 4.9, published 27 January 2017.
Which products and versions are affected?: Oracle MySQL Server 5.7.16 and earlier.
Is there a fix for CVE-2017-3251?: A patch was published on 2017-10-12: Red Hat released updates for rh-mysql57-mysql (5.7.19) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-3251 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2017-3251?: Check whether you run Oracle Mysql or Oracle MySQL Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unspecified vulnerability exists in the Server: Optimizer subcomponent of Oracle MySQL Server versions 5.7.16 and earlier. The flaw is easily exploitable by a high-privileged attacker with network access via multiple protocols. Successful exploitation allows the attacker to cause a hang or a frequently repeatable crash of the MySQL Server, resulting in a complete denial of service (DoS). The vulnerability was addressed in the Oracle Critical Patch Update for January 2017, with fixes included in MySQL version 5.7.17 and later.

Affected products

Oracle MySQL Server 5.7.16 and earlier

Timeline

2017-01-27: advisory: Initial publication of CVE-2017-3251 by Oracle
2017-10-12: patched: Red Hat released updates for rh-mysql57-mysql (5.7.19)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.