Amazon Linux AMI update for mysql55



Risk Low
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2017-10379
CVE-2017-10378
CVE-2017-10384
CVE-2017-10268
CWE-ID CWE-200
CWE-284
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Amazon Linux AMI
Operating systems & Components / Operating system

Vendor Amazon Web Services

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU9010

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10379

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote low-privileged attacker to obtain potentially sensitive information on the target system.

The weakness exists due to an error in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). A remote attacker can gain unauthorized access to critical data or complete access to all MySQL Server accessible data.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation

Update the affected packages.

i686:
    mysql-config-5.5.58-1.19.amzn1.i686
    mysql55-embedded-5.5.58-1.19.amzn1.i686
    mysql55-server-5.5.58-1.19.amzn1.i686
    mysql55-5.5.58-1.19.amzn1.i686
    mysql55-test-5.5.58-1.19.amzn1.i686
    mysql55-bench-5.5.58-1.19.amzn1.i686
    mysql55-libs-5.5.58-1.19.amzn1.i686
    mysql55-debuginfo-5.5.58-1.19.amzn1.i686
    mysql55-embedded-devel-5.5.58-1.19.amzn1.i686
    mysql55-devel-5.5.58-1.19.amzn1.i686

src:
    mysql55-5.5.58-1.19.amzn1.src

x86_64:
    mysql55-test-5.5.58-1.19.amzn1.x86_64
    mysql55-embedded-5.5.58-1.19.amzn1.x86_64
    mysql55-server-5.5.58-1.19.amzn1.x86_64
    mysql55-embedded-devel-5.5.58-1.19.amzn1.x86_64
    mysql55-debuginfo-5.5.58-1.19.amzn1.x86_64
    mysql55-libs-5.5.58-1.19.amzn1.x86_64
    mysql55-5.5.58-1.19.amzn1.x86_64
    mysql-config-5.5.58-1.19.amzn1.x86_64
    mysql55-devel-5.5.58-1.19.amzn1.x86_64
    mysql55-bench-5.5.58-1.19.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

https://alas.aws.amazon.com/ALAS-2017-927.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Denial of service

EUVDB-ID: #VU9009

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10378

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote low-privileged attacker to cause DoS condition on the target system.

The weakness exists due to an error in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). A remote attacker can use multiple protocols to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Update the affected packages.

i686:
    mysql-config-5.5.58-1.19.amzn1.i686
    mysql55-embedded-5.5.58-1.19.amzn1.i686
    mysql55-server-5.5.58-1.19.amzn1.i686
    mysql55-5.5.58-1.19.amzn1.i686
    mysql55-test-5.5.58-1.19.amzn1.i686
    mysql55-bench-5.5.58-1.19.amzn1.i686
    mysql55-libs-5.5.58-1.19.amzn1.i686
    mysql55-debuginfo-5.5.58-1.19.amzn1.i686
    mysql55-embedded-devel-5.5.58-1.19.amzn1.i686
    mysql55-devel-5.5.58-1.19.amzn1.i686

src:
    mysql55-5.5.58-1.19.amzn1.src

x86_64:
    mysql55-test-5.5.58-1.19.amzn1.x86_64
    mysql55-embedded-5.5.58-1.19.amzn1.x86_64
    mysql55-server-5.5.58-1.19.amzn1.x86_64
    mysql55-embedded-devel-5.5.58-1.19.amzn1.x86_64
    mysql55-debuginfo-5.5.58-1.19.amzn1.x86_64
    mysql55-libs-5.5.58-1.19.amzn1.x86_64
    mysql55-5.5.58-1.19.amzn1.x86_64
    mysql-config-5.5.58-1.19.amzn1.x86_64
    mysql55-devel-5.5.58-1.19.amzn1.x86_64
    mysql55-bench-5.5.58-1.19.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

https://alas.aws.amazon.com/ALAS-2017-927.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Denial of service

EUVDB-ID: #VU9011

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10384

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote low-privileged attacker to cause DoS condition on the target system.

The weakness exists due to an error in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). A remote attacker can use multiple protocols to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Update the affected packages.

i686:
    mysql-config-5.5.58-1.19.amzn1.i686
    mysql55-embedded-5.5.58-1.19.amzn1.i686
    mysql55-server-5.5.58-1.19.amzn1.i686
    mysql55-5.5.58-1.19.amzn1.i686
    mysql55-test-5.5.58-1.19.amzn1.i686
    mysql55-bench-5.5.58-1.19.amzn1.i686
    mysql55-libs-5.5.58-1.19.amzn1.i686
    mysql55-debuginfo-5.5.58-1.19.amzn1.i686
    mysql55-embedded-devel-5.5.58-1.19.amzn1.i686
    mysql55-devel-5.5.58-1.19.amzn1.i686

src:
    mysql55-5.5.58-1.19.amzn1.src

x86_64:
    mysql55-test-5.5.58-1.19.amzn1.x86_64
    mysql55-embedded-5.5.58-1.19.amzn1.x86_64
    mysql55-server-5.5.58-1.19.amzn1.x86_64
    mysql55-embedded-devel-5.5.58-1.19.amzn1.x86_64
    mysql55-debuginfo-5.5.58-1.19.amzn1.x86_64
    mysql55-libs-5.5.58-1.19.amzn1.x86_64
    mysql55-5.5.58-1.19.amzn1.x86_64
    mysql-config-5.5.58-1.19.amzn1.x86_64
    mysql55-devel-5.5.58-1.19.amzn1.x86_64
    mysql55-bench-5.5.58-1.19.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

https://alas.aws.amazon.com/ALAS-2017-927.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Information disclosure

EUVDB-ID: #VU8995

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10268

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local high-privileged attacker to obtain potentially sensitive information on the target system.

The weakness exists due to an error in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). A local attacker can gain unauthorized access to critical data or complete access to all MySQL Server accessible data.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation

Update the affected packages.

i686:
    mysql-config-5.5.58-1.19.amzn1.i686
    mysql55-embedded-5.5.58-1.19.amzn1.i686
    mysql55-server-5.5.58-1.19.amzn1.i686
    mysql55-5.5.58-1.19.amzn1.i686
    mysql55-test-5.5.58-1.19.amzn1.i686
    mysql55-bench-5.5.58-1.19.amzn1.i686
    mysql55-libs-5.5.58-1.19.amzn1.i686
    mysql55-debuginfo-5.5.58-1.19.amzn1.i686
    mysql55-embedded-devel-5.5.58-1.19.amzn1.i686
    mysql55-devel-5.5.58-1.19.amzn1.i686

src:
    mysql55-5.5.58-1.19.amzn1.src

x86_64:
    mysql55-test-5.5.58-1.19.amzn1.x86_64
    mysql55-embedded-5.5.58-1.19.amzn1.x86_64
    mysql55-server-5.5.58-1.19.amzn1.x86_64
    mysql55-embedded-devel-5.5.58-1.19.amzn1.x86_64
    mysql55-debuginfo-5.5.58-1.19.amzn1.x86_64
    mysql55-libs-5.5.58-1.19.amzn1.x86_64
    mysql55-5.5.58-1.19.amzn1.x86_64
    mysql-config-5.5.58-1.19.amzn1.x86_64
    mysql55-devel-5.5.58-1.19.amzn1.x86_64
    mysql55-bench-5.5.58-1.19.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

https://alas.aws.amazon.com/ALAS-2017-927.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###