Amazon Linux AMI update for mysql56

1) Improper input validation

EUVDB-ID: #VU26937

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-2763

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Replication component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    mysql56-embedded-5.6.49-1.37.amzn1.i686
    mysql56-libs-5.6.49-1.37.amzn1.i686
    mysql56-5.6.49-1.37.amzn1.i686
    mysql56-bench-5.6.49-1.37.amzn1.i686
    mysql56-common-5.6.49-1.37.amzn1.i686
    mysql56-server-5.6.49-1.37.amzn1.i686
    mysql56-test-5.6.49-1.37.amzn1.i686
    mysql56-debuginfo-5.6.49-1.37.amzn1.i686
    mysql56-errmsg-5.6.49-1.37.amzn1.i686
    mysql56-embedded-devel-5.6.49-1.37.amzn1.i686
    mysql56-devel-5.6.49-1.37.amzn1.i686

src:
    mysql56-5.6.49-1.37.amzn1.src

x86_64:
    mysql56-embedded-devel-5.6.49-1.37.amzn1.x86_64
    mysql56-libs-5.6.49-1.37.amzn1.x86_64
    mysql56-errmsg-5.6.49-1.37.amzn1.x86_64
    mysql56-common-5.6.49-1.37.amzn1.x86_64
    mysql56-devel-5.6.49-1.37.amzn1.x86_64
    mysql56-server-5.6.49-1.37.amzn1.x86_64
    mysql56-test-5.6.49-1.37.amzn1.x86_64
    mysql56-5.6.49-1.37.amzn1.x86_64
    mysql56-embedded-5.6.49-1.37.amzn1.x86_64
    mysql56-debuginfo-5.6.49-1.37.amzn1.x86_64
    mysql56-bench-5.6.49-1.37.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2020-1402.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper input validation

EUVDB-ID: #VU26911

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-2780

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: DML component in MySQL Server. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    mysql56-embedded-5.6.49-1.37.amzn1.i686
    mysql56-libs-5.6.49-1.37.amzn1.i686
    mysql56-5.6.49-1.37.amzn1.i686
    mysql56-bench-5.6.49-1.37.amzn1.i686
    mysql56-common-5.6.49-1.37.amzn1.i686
    mysql56-server-5.6.49-1.37.amzn1.i686
    mysql56-test-5.6.49-1.37.amzn1.i686
    mysql56-debuginfo-5.6.49-1.37.amzn1.i686
    mysql56-errmsg-5.6.49-1.37.amzn1.i686
    mysql56-embedded-devel-5.6.49-1.37.amzn1.i686
    mysql56-devel-5.6.49-1.37.amzn1.i686

src:
    mysql56-5.6.49-1.37.amzn1.src

x86_64:
    mysql56-embedded-devel-5.6.49-1.37.amzn1.x86_64
    mysql56-libs-5.6.49-1.37.amzn1.x86_64
    mysql56-errmsg-5.6.49-1.37.amzn1.x86_64
    mysql56-common-5.6.49-1.37.amzn1.x86_64
    mysql56-devel-5.6.49-1.37.amzn1.x86_64
    mysql56-server-5.6.49-1.37.amzn1.x86_64
    mysql56-test-5.6.49-1.37.amzn1.x86_64
    mysql56-5.6.49-1.37.amzn1.x86_64
    mysql56-embedded-5.6.49-1.37.amzn1.x86_64
    mysql56-debuginfo-5.6.49-1.37.amzn1.x86_64
    mysql56-bench-5.6.49-1.37.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2020-1402.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper input validation

EUVDB-ID: #VU26914

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-2804

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Memcached component in MySQL Server. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    mysql56-embedded-5.6.49-1.37.amzn1.i686
    mysql56-libs-5.6.49-1.37.amzn1.i686
    mysql56-5.6.49-1.37.amzn1.i686
    mysql56-bench-5.6.49-1.37.amzn1.i686
    mysql56-common-5.6.49-1.37.amzn1.i686
    mysql56-server-5.6.49-1.37.amzn1.i686
    mysql56-test-5.6.49-1.37.amzn1.i686
    mysql56-debuginfo-5.6.49-1.37.amzn1.i686
    mysql56-errmsg-5.6.49-1.37.amzn1.i686
    mysql56-embedded-devel-5.6.49-1.37.amzn1.i686
    mysql56-devel-5.6.49-1.37.amzn1.i686

src:
    mysql56-5.6.49-1.37.amzn1.src

x86_64:
    mysql56-embedded-devel-5.6.49-1.37.amzn1.x86_64
    mysql56-libs-5.6.49-1.37.amzn1.x86_64
    mysql56-errmsg-5.6.49-1.37.amzn1.x86_64
    mysql56-common-5.6.49-1.37.amzn1.x86_64
    mysql56-devel-5.6.49-1.37.amzn1.x86_64
    mysql56-server-5.6.49-1.37.amzn1.x86_64
    mysql56-test-5.6.49-1.37.amzn1.x86_64
    mysql56-5.6.49-1.37.amzn1.x86_64
    mysql56-embedded-5.6.49-1.37.amzn1.x86_64
    mysql56-debuginfo-5.6.49-1.37.amzn1.x86_64
    mysql56-bench-5.6.49-1.37.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2020-1402.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper input validation

EUVDB-ID: #VU26942

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-2812

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Stored Procedure component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    mysql56-embedded-5.6.49-1.37.amzn1.i686
    mysql56-libs-5.6.49-1.37.amzn1.i686
    mysql56-5.6.49-1.37.amzn1.i686
    mysql56-bench-5.6.49-1.37.amzn1.i686
    mysql56-common-5.6.49-1.37.amzn1.i686
    mysql56-server-5.6.49-1.37.amzn1.i686
    mysql56-test-5.6.49-1.37.amzn1.i686
    mysql56-debuginfo-5.6.49-1.37.amzn1.i686
    mysql56-errmsg-5.6.49-1.37.amzn1.i686
    mysql56-embedded-devel-5.6.49-1.37.amzn1.i686
    mysql56-devel-5.6.49-1.37.amzn1.i686

src:
    mysql56-5.6.49-1.37.amzn1.src

x86_64:
    mysql56-embedded-devel-5.6.49-1.37.amzn1.x86_64
    mysql56-libs-5.6.49-1.37.amzn1.x86_64
    mysql56-errmsg-5.6.49-1.37.amzn1.x86_64
    mysql56-common-5.6.49-1.37.amzn1.x86_64
    mysql56-devel-5.6.49-1.37.amzn1.x86_64
    mysql56-server-5.6.49-1.37.amzn1.x86_64
    mysql56-test-5.6.49-1.37.amzn1.x86_64
    mysql56-5.6.49-1.37.amzn1.x86_64
    mysql56-embedded-5.6.49-1.37.amzn1.x86_64
    mysql56-debuginfo-5.6.49-1.37.amzn1.x86_64
    mysql56-bench-5.6.49-1.37.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2020-1402.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper input validation

EUVDB-ID: #VU26920

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-2814

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    mysql56-embedded-5.6.49-1.37.amzn1.i686
    mysql56-libs-5.6.49-1.37.amzn1.i686
    mysql56-5.6.49-1.37.amzn1.i686
    mysql56-bench-5.6.49-1.37.amzn1.i686
    mysql56-common-5.6.49-1.37.amzn1.i686
    mysql56-server-5.6.49-1.37.amzn1.i686
    mysql56-test-5.6.49-1.37.amzn1.i686
    mysql56-debuginfo-5.6.49-1.37.amzn1.i686
    mysql56-errmsg-5.6.49-1.37.amzn1.i686
    mysql56-embedded-devel-5.6.49-1.37.amzn1.i686
    mysql56-devel-5.6.49-1.37.amzn1.i686

src:
    mysql56-5.6.49-1.37.amzn1.src

x86_64:
    mysql56-embedded-devel-5.6.49-1.37.amzn1.x86_64
    mysql56-libs-5.6.49-1.37.amzn1.x86_64
    mysql56-errmsg-5.6.49-1.37.amzn1.x86_64
    mysql56-common-5.6.49-1.37.amzn1.x86_64
    mysql56-devel-5.6.49-1.37.amzn1.x86_64
    mysql56-server-5.6.49-1.37.amzn1.x86_64
    mysql56-test-5.6.49-1.37.amzn1.x86_64
    mysql56-5.6.49-1.37.amzn1.x86_64
    mysql56-embedded-5.6.49-1.37.amzn1.x86_64
    mysql56-debuginfo-5.6.49-1.37.amzn1.x86_64
    mysql56-bench-5.6.49-1.37.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2020-1402.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Medium
Patch available	YES
Number of vulnerabilities	5
CVE-ID	CVE-2020-2763 CVE-2020-2780 CVE-2020-2804 CVE-2020-2812 CVE-2020-2814
CWE-ID	CWE-20
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Amazon Linux AMI Operating systems & Components / Operating system
Vendor	Amazon Web Services