Information disclosure in mariadb (Alpine package)



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2017-10268
CWE-ID CWE-200
Exploitation vector Local
Public exploit N/A
Vulnerable software
 mariadb (Alpine package)
Operating systems & Components / Operating system package or component

Vendor Alpine Linux Development Team

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Information disclosure

EUVDB-ID: #VU8995

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10268

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local high-privileged attacker to obtain potentially sensitive information on the target system.

The weakness exists due to an error in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). A local attacker can gain unauthorized access to critical data or complete access to all MySQL Server accessible data.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation

Install update from vendor's website.

Vulnerable software versions

mariadb (Alpine package): 10.1.26-r0

CPE2.3 External links

https://git.alpinelinux.org/aports/commit/?id=073f1dbb6b8e23211fdfc552d7fc9a1e5a1cd7d1
https://git.alpinelinux.org/aports/commit/?id=0af8e020357e06efb024840fcd0c25246bec62db
https://git.alpinelinux.org/aports/commit/?id=1f62ce8da4f9d806efed413128423df6193398cd


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###