Is CVE-2017-3257 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-3257 being exploited in the wild.

How severe is CVE-2017-3257?

Medium severity, with a CVSS score of 6.5, published 27 January 2017.

Which products and versions are affected?

Oracle MySQL Server 5.6.34 and earlier, 5.7.16 and earlier.

Is there a fix for CVE-2017-3257?

A patch was published on 2017-01-22: Debian/MariaDB security update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-3257 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2017-3257?

Check whether you run Oracle MySQL Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-3257: Oracle MySQL InnoDB denial of service vulnerability

CVE-2017-3257 · Severity: medium · CVSS 6.5 · Published 2017-01-27

A vulnerability in the InnoDB storage engine of Oracle MySQL and MariaDB allows an attacker to crash the database service. This component is responsible for managing how data is stored and retrieved; an exploit results in a complete denial of service, making the database unavailable for applications and users. The issue affects older versions of MySQL 5.6 and 5.7, as well as several MariaDB versions.

Technologies: Oracle MySQL Server. Vendors: Oracle.

Quick answers

Is CVE-2017-3257 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-3257 being exploited in the wild.
How severe is CVE-2017-3257?: Medium severity, with a CVSS score of 6.5, published 27 January 2017.
Which products and versions are affected?: Oracle MySQL Server 5.6.34 and earlier, 5.7.16 and earlier.
Is there a fix for CVE-2017-3257?: A patch was published on 2017-01-22: Debian/MariaDB security update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-3257 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2017-3257?: Check whether you run Oracle MySQL Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the InnoDB subcomponent of MySQL Server (versions 5.6.34 and earlier, 5.7.16 and earlier) and MariaDB. The flaw allows a low-privileged attacker with network access via multiple protocols to trigger a hang or a frequently repeatable crash of the MySQL service. This results in a complete loss of availability (Denial of Service). The vulnerability is classified under CWE-269 (Improper Privilege Management) by NIST, though it is primarily an availability impact. Patches were released by Oracle in the January 2017 Critical Patch Update and by MariaDB in versions 10.0.29, 10.1.21, and 10.2.8.

Affected products

Oracle MySQL Server 5.6.34 and earlier, 5.7.16 and earlier
MariaDB Foundation MariaDB 10.0.x before 10.0.29, 10.1.x before 10.1.21, 10.2.x before 10.2.8

Timeline

2017-01-17: advisory: Oracle January 2017 Critical Patch Update released
2017-01-22: patched: Debian/MariaDB security update released
2017-01-27: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.