Junglewise Threat Intelligence

CVE-2017-3258: Oracle MySQL and MariaDB denial of service in DDL subcomponent

CVE-2017-3258 · Severity: medium · CVSS 6.5 · Published 2017-01-27

Technologies: Oracle MySQL Server. Vendors: MariaDB Foundation, Oracle.

Executive brief

A vulnerability in the MySQL and MariaDB database servers could allow a user with low-level access to crash the database service remotely. This component is responsible for managing data structures, and an exploit would result in a complete denial of service, making the database and any dependent applications unavailable. Organizations relying on these databases for operations or customer-facing services may experience significant downtime until the service is manually restarted.

Technical details

A vulnerability exists in the Server: DDL (Data Definition Language) subcomponent of Oracle MySQL and MariaDB. The flaw is caused by improper input validation during DDL operations. An attacker with low-privileged network access can exploit this vulnerability via multiple protocols to trigger a hang or a frequently repeatable crash (Denial of Service). The issue affects MySQL versions up to 5.5.53, 5.6.34, and 5.7.16, as well as several MariaDB versions. Patches are available in MySQL 5.5.54, 5.6.35, 5.7.17, and MariaDB 10.0.29 / 10.1.21.

Affected products

  • Oracle MySQL Server 5.5.53 and earlier, 5.6.34 and earlier, 5.7.16 and earlier
  • MariaDB Foundation MariaDB 5.5.0 to 5.5.53, 10.0.0 to 10.0.28, 10.1.0 to 10.1.20

Timeline

  • 2017-01-17: advisory: Oracle Critical Patch Update (CPU) published
  • 2017-01-19: patched: Debian released fixed mysql-5.5 packages
  • 2017-01-27: disclosed: NVD publication date

References

Related threats