Junglewise Threat Intelligence

CVE-2017-3265: Oracle MySQL and MariaDB privilege escalation in Server Packaging

CVE-2017-3265 · Severity: medium · CVSS 5.6 · Published 2017-01-27

Technologies: Oracle MySQL Server. Vendors: Oracle, MariaDB Foundation.

Executive brief

A vulnerability in the MySQL and MariaDB database server packaging and initialization scripts could allow a highly privileged local user to compromise the database. If exploited, an attacker could gain unauthorized access to all database data or cause the server to crash, leading to a service outage. This attack is difficult to perform as it requires specific local access and interaction from another user.

Technical details

The vulnerability exists within the MySQL/MariaDB init scripts and packaging subcomponent, specifically related to how the database data directory is initialized and how permissions are set on error log files. A local attacker with high privileges (such as the 'mysql' operating system user) can exploit these flaws to escalate privileges to root or gain unauthorized access to all MySQL-accessible data. The attack is characterized by high complexity, requiring local infrastructure access and human interaction from a person other than the attacker. Impact includes potential for a complete denial-of-service (DOS) via repeatable crashes and unauthorized confidentiality loss. Patches are available in MySQL 5.5.54, 5.6.35, 5.7.17 and MariaDB 10.0.29.

Affected products

  • Oracle MySQL Server 5.5.53 and earlier, 5.6.34 and earlier, 5.7.16 and earlier
  • MariaDB Foundation MariaDB 5.5.0 up to 5.5.54, 10.0.0 up to 10.0.29, 10.1.0 up to 10.1.21

Timeline

  • 2017-01-19: advisory: Debian released DSA-3767-1 for mysql-5.5
  • 2017-01-27: disclosed: NVD publication date

References

Related threats