Is CVE-2017-3256 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-3256 being exploited in the wild.

How severe is CVE-2017-3256?

Medium severity, with a CVSS score of 6.5, published 27 January 2017.

Which products and versions are affected?

Oracle MySQL Server 5.7.16 and earlier.

Is there a fix for CVE-2017-3256?

A patch was published on 2017-01-17: Oracle Critical Patch Update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-3256 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2017-3256?

Check whether you run Oracle Mysql or Oracle MySQL Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-3256: Oracle MySQL Server denial of service in Replication component

CVE-2017-3256 · Severity: medium · CVSS 6.5 · Published 2017-01-27

A vulnerability in the replication component of Oracle MySQL Server can allow a low-privileged user to crash the database service. This affects the availability of the database, potentially leading to service outages and business disruption. Organizations using affected versions should apply the available security patches to ensure continuous operations.

Technologies: Oracle Mysql, Oracle MySQL Server. Vendors: Oracle.

Quick answers

Is CVE-2017-3256 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-3256 being exploited in the wild.
How severe is CVE-2017-3256?: Medium severity, with a CVSS score of 6.5, published 27 January 2017.
Which products and versions are affected?: Oracle MySQL Server 5.7.16 and earlier.
Is there a fix for CVE-2017-3256?: A patch was published on 2017-01-17: Oracle Critical Patch Update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-3256 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2017-3256?: Check whether you run Oracle Mysql or Oracle MySQL Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unspecified vulnerability exists in the Server: Replication subcomponent of Oracle MySQL Server. The flaw is categorized as improper input validation (CWE-20) and is easily exploitable by a low-privileged attacker with network access via multiple protocols. A successful exploit allows the attacker to cause a complete denial of service (DoS) by repeatedly crashing or hanging the MySQL Server process. The vulnerability affects version 5.7.16 and earlier and was addressed in the Oracle Critical Patch Update for January 2017.

Affected products

Oracle MySQL Server 5.7.16 and earlier

Timeline

2017-01-27: advisory: Initial NVD publication
2017-01-17: patched: Oracle Critical Patch Update released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.