Junglewise Threat Intelligence

CVE-2017-3257: Oracle MySQL InnoDB denial of service vulnerability

CVE-2017-3257 · Severity: medium · CVSS 6.5 · Published 2017-01-27

Technologies: Oracle MySQL Server. Vendors: MariaDB Foundation, Oracle.

Executive brief

A vulnerability in the InnoDB storage engine of Oracle MySQL and MariaDB allows an attacker to crash the database service. This component is responsible for managing how data is stored and retrieved; an exploit results in a complete denial of service, making the database unavailable for applications and users. The issue affects older versions of MySQL 5.6 and 5.7, as well as several MariaDB versions.

Technical details

A vulnerability exists in the InnoDB subcomponent of MySQL Server (versions 5.6.34 and earlier, 5.7.16 and earlier) and MariaDB. The flaw allows a low-privileged attacker with network access via multiple protocols to trigger a hang or a frequently repeatable crash of the MySQL service. This results in a complete loss of availability (Denial of Service). The vulnerability is classified under CWE-269 (Improper Privilege Management) by NIST, though it is primarily an availability impact. Patches were released by Oracle in the January 2017 Critical Patch Update and by MariaDB in versions 10.0.29, 10.1.21, and 10.2.8.

Affected products

  • Oracle MySQL Server 5.6.34 and earlier, 5.7.16 and earlier
  • MariaDB Foundation MariaDB 10.0.x before 10.0.29, 10.1.x before 10.1.21, 10.2.x before 10.2.8

Timeline

  • 2017-01-17: advisory: Oracle January 2017 Critical Patch Update released
  • 2017-01-22: patched: Debian/MariaDB security update released
  • 2017-01-27: disclosed: NVD publication date

References

Related threats