CVE-2016-6662
published 2016-09-20CVE-2016-6662: Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and…
PriorityP188critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
67.73%
99.2th percentile
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| mariadb | mariadb | >= 0 < 5.5.51-r0 | 5.5.51-r0 |
| mariadb | mariadb | >= 0 < 10.1.17-r0 | 10.1.17-r0 |
| mariadb | mariadb | >= 10.0.0 < 10.0.27 | 10.0.27 |
| mariadb | mariadb | >= 10.1.0 < 10.1.17 | 10.1.17 |
| mariadb | mariadb | >= 5.5.20 < 5.5.51 | 5.5.51 |
| oracle | mysql | 5.5.0 – 5.5.52 | — |
| oracle | mysql | 5.6.0 – 5.6.33 | — |
| oracle | mysql | 5.7.0 – 5.7.15 | — |
| percona | percona_server | >= 5.5 < 5.5.51-38.1 | 5.5.51-38.1 |
| percona | percona_server | >= 5.6 < 5.6.32-78.0 | 5.6.32-78.0 |
| percona | percona_server | >= 5.7 < 5.7.14-7 | 5.7.14-7 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
Detection & IOCsextracted from sources · hover to see the quote
port3306
snort
alert tcp any any -> $HOME_NET 3306 (msg:"ET EXPLOIT Possible MySQL CVE-2016-6662 Attempt"; flow:established,to_server; content:"|03|"; offset:4; content:"unhex"; nocase; distance:0; content:"67656e6572616c5f6c6f675f66696c65"; distance:0; nocase; content:"2e636e66"; nocase; content:"6e6d616c6c6f635f6c6962"; reference:cve,2016-6662; reference:url,legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html; classtype:attempted-admin; sid:2023201; rev:1; metadata:affected_product MySQL, attack_target Server, created_at 2016_09_13, cve CVE_2016_6662, deployment Datacenter, confidence Medium, signature_severity Major, updated_at 2019_07_26;)
bytes
67656e6572616c5f6c6f675f66696c65
bytes
2e636e66
bytes
6e6d616c6c6f635f6c6962
- →Detect MySQL traffic on port 3306 containing 'unhex' combined with hex-encoded strings for 'general_log_file' (67656e6572616c5f6c6f675f66696c65), '.cnf' (2e636e66), and 'malloc_lib' (6e6d616c6c6f635f6c6962) — the core exploit write-to-config pattern.
- →Monitor for creation of or writes to /etc/ld.so.preload by the mysql user, which is the privilege escalation mechanism used by the exploit chain. ↗
- →Detect presence of poctable.TRG trigger file written into MySQL data directory (/var/lib/mysql/<db>/poctable.TRG), which is used to inject the malloc_lib setting into my.cnf. ↗
- →Monitor for mysql_hookandroot_lib.so or privesclib.so appearing in /var/lib/mysql/ or /tmp/, as these are the malicious shared libraries dropped by the exploit. ↗
- →Watch for a netcat listener spawned on port 6033 (inverted MySQL port 3306) following MySQL restart, indicating successful remote root shell establishment. ↗
- →Detect MySQL SQL statements that set general_log_file to a path ending in .cnf (e.g., my.cnf), which is the core config-injection technique. ↗
- ·Red Hat/CentOS default installs are partially mitigated: my.cnf in /etc is root-owned and not writable by the mysql user, blocking the published exploit vector. ↗
- ·On RHEL 7, mysqld_safe runs as the mysql user (not root), limiting exploit impact to code execution as the mysql system user rather than full root. ↗
- ·MySQL 5.1 on RHEL 6 does not support library preloading, completely preventing the malloc_lib remote attack vector. ↗
- ·Granting FILE privilege to non-administrative database users (e.g., web app accounts) enables exploitation; restrict FILE privilege and use secure_file_priv to limit file write locations. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv9.8CRITICAL
vulncheck9.8CRITICAL
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-76m2-pqh7-www3: Oracle MySQL through 5
ghsa_unreviewed·2022-05-13
CVE-2016-6662 [CRITICAL] GHSA-76m2-pqh7-www3: Oracle MySQL through 5
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.
OSV
CVE-2016-6662: Oracle MySQL through 5
osv·2016-09-20·CVSS 9.8
CVE-2016-6662 [CRITICAL] CVE-2016-6662: Oracle MySQL through 5
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.
VulnCheck
MySQL, MariaDB, Percona malloc_lib Remote Root Code Execution
vulncheck·2016·CVSS 9.8
CVE-2016-6662 [CRITICAL] MySQL, MariaDB, Percona malloc_lib Remote Root Code Execution
MySQL, MariaDB, Percona malloc_lib Remote Root Code Execution
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.
Affected: Oracle mysql
Required Action: Apply r
Ubuntu
MySQL vulnerability
vendor_ubuntu·2016-09-13
CVE-2016-6662 MySQL vulnerability
Title: MySQL vulnerability
Summary: MySQL could be made to run programs as an administrator.
Dawid Golunski discovered that MySQL incorrectly handled configuration
files. A remote attacker could possibly use this issue to execute arbitrary
code with root privileges.
MySQL has been updated to 5.5.52 in Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
Ubuntu 16.04 LTS has been updated to MySQL 5.7.15.
In addition to security fixes, the updated packages contain bug fixes,
new features, and possibly incompatible changes.
Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-51.html
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-52.html
http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-14.html
http://dev.mysql.com/doc/relnotes/mysql/5.7
Red Hat
mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016)
vendor_redhat·2016-09-12·CVSS 9.8
CVE-2016-6662 [CRITICAL] CWE-732 mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016)
mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016)
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.
It was dis
Suricata
ET EXPLOIT Possible MySQL CVE-2016-6662 Attempt
suricata·2016-09-13·CVSS 9.8
CVE-2016-6662 [CRITICAL] ET EXPLOIT Possible MySQL CVE-2016-6662 Attempt
ET EXPLOIT Possible MySQL CVE-2016-6662 Attempt
Rule: alert tcp any any -> $HOME_NET 3306 (msg:"ET EXPLOIT Possible MySQL CVE-2016-6662 Attempt"; flow:established,to_server; content:"|03|"; offset:4; content:"unhex"; nocase; distance:0; content:"67656e6572616c5f6c6f675f66696c65"; distance:0; nocase; content:"2e636e66"; nocase; content:"6e6d616c6c6f635f6c6962"; reference:cve,2016-6662; reference:url,legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html; classtype:attempted-admin; sid:2023201; rev:1; metadata:affected_product MySQL, attack_target Server, created_at 2016_09_13, cve CVE_2016_6662, deployment Datacenter, confidence Medium, signature_severity Major, updated_at 2019_07_26;)
Suricata
ET EXPLOIT Possible MySQL cnf overwrite CVE-2016-6662 Attempt
suricata·2016-09-13·CVSS 9.8
CVE-2016-6662 [CRITICAL] ET EXPLOIT Possible MySQL cnf overwrite CVE-2016-6662 Attempt
ET EXPLOIT Possible MySQL cnf overwrite CVE-2016-6662 Attempt
Rule: alert tcp any any -> $HOME_NET 3306 (msg:"ET EXPLOIT Possible MySQL cnf overwrite CVE-2016-6662 Attempt"; flow:established,to_server; content:"|03|"; offset:4; content:"global_log_dir"; nocase; distance:0; content:".cnf"; nocase; distance:0; content:"nmalloc_lib"; fast_pattern; reference:cve,2016-6662; reference:url,legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html; classtype:attempted-admin; sid:2023202; rev:2; metadata:affected_product MySQL, attack_target Server, created_at 2016_09_13, cve CVE_2016_6662, deployment Datacenter, confidence Medium, signature_severity Major, updated_at 2019_10_08;)
Exploit-DB
MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - 'root' System User Privilege Escalation
exploitdb·2016-11-01·CVSS 9.8
CVE-2016-6664 [CRITICAL] MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - 'root' System User Privilege Escalation
MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - 'root' System User Privilege Escalation
---
#!/bin/bash -p
#
# Source: https://legalhackers.com/advisories/MySQL-Maria-Percona-RootPrivEsc-CVE-2016-6664-5617-Exploit.html // http://legalhackers.com/exploits/CVE-2016-6664/mysql-chowned.sh
#
# MySQL / MariaDB / PerconaDB - Root Privilege Escalation PoC Exploit
# mysql-chowned.sh (ver. 1.0)
#
# CVE-2016-6664 / OCVE-2016-5617
#
# Discovered and coded by:
#
# Dawid Golunski
# dawid[at]legalhackers.com
#
# https://legalhackers.com
#
# Follow https://twitter.com/dawid_golunski for updates on this advisory.
#
# This PoC exploit allows attackers to (instantly) escalate their privileges
# from mysql system account to root through unsafe error log handling.
# The exploit requires that file-based loggi
Exploit-DB
MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - 'mysql' System User Privilege Escalation / Race Condition
exploitdb·2016-11-01·CVSS 7.0
CVE-2016-6663 [HIGH] MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - 'mysql' System User Privilege Escalation / Race Condition
MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - 'mysql' System User Privilege Escalation / Race Condition
---
/*
Source: https://legalhackers.com/advisories/MySQL-Maria-Percona-PrivEscRace-CVE-2016-6663-5616-Exploit.html // http://legalhackers.com/exploits/CVE-2016-6663/mysql-privesc-race.c
MySQL/PerconaDB/MariaDB - Privilege Escalation / Race Condition PoC Exploit
mysql-privesc-race.c (ver. 1.0)
CVE-2016-6663 / OCVE-2016-5616
Discovered/Coded by:
Dawid Golunski
dawid[at]legalhackers.com
https://legalhackers.com
Follow https://twitter.com/dawid_golunski for updates on this advisory.
Compile:
gcc mysql-privesc-race.c -o mysql-privesc-race -I/usr/include/mysql -lmysqlclient
Note:
* On RedHat-based systems you might need to change /tmp to another public directory (e.g. /uploads)
*
Exploit-DB
MySQL / MariaDB / PerconaDB 5.5.51/5.6.32/5.7.14 - Code Execution / Privilege Escalation
exploitdb·2016-09-12·CVSS 9.8
CVE-2016-6662 [CRITICAL] MySQL / MariaDB / PerconaDB 5.5.51/5.6.32/5.7.14 - Code Execution / Privilege Escalation
MySQL / MariaDB / PerconaDB 5.5.51/5.6.32/5.7.14 - Code Execution / Privilege Escalation
---
#!/usr/bin/python
#
# MySQL / MariaDB / Percona - Remote Root Code Execution / PrivEsc PoC Exploit
# (CVE-2016-6662)
# 0ldSQL_MySQL_RCE_exploit.py (ver. 1.0)
#
# For testing purposes only. Do no harm.
#
# Discovered/Coded by:
#
# Dawid Golunski
# http://legalhackers.com
#
#
# This is a limited version of the PoC exploit. It only allows appending to
# existing mysql config files with weak permissions. See V) 1) section of
# the advisory for details on this vector.
#
# Full PoC will be released at a later date, and will show how attackers could
# exploit the vulnerability on default installations of MySQL on systems with no
# writable my.cnf config files available.
#
# The upcoming advisory CVE-20
Bugzilla
CVE-2017-3291 mysql: unrestricted mysqld_safe's ledir (CPU Jan 2017)
bugzilla·2017-01-18·CVSS 9.8
CVE-2017-3291 [CRITICAL] CVE-2017-3291 mysql: unrestricted mysqld_safe's ledir (CPU Jan 2017)
CVE-2017-3291 mysql: unrestricted mysqld_safe's ledir (CPU Jan 2017)
It was discovered that the mysqld_safe could read ledir value - which specifies the directory where mysqld is stored - from configuration file. This could allow a user with privileges to write to some mysql configuration file - either mysql OS user, or any local OS user able to write to the config via some other way, e.g. by exploiting CVE-2016-6662 - to escalate their privileges to root if mysqld_safe was run with root privileges.
This problem is related to this change applied as part of the CVE-2016-6662 fix:
https://github.com/mysql/mysql-server/commit/684a165f28b3718160a3e4c5ebd18a465d85e97c#diff-144aa2f11374843c969d96b7b84247eaR211
It introduced restriction that mysqld and mysqld_version options can only be speci
Bugzilla
CVE-2017-3312 mysql: insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 fix (CPU Jan 2017)
bugzilla·2017-01-17·CVSS 7.0
CVE-2017-3312 [HIGH] CVE-2017-3312 mysql: insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 fix (CPU Jan 2017)
CVE-2017-3312 mysql: insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 fix (CPU Jan 2017)
MySQL versions 5.5.52, 5.6.33, and 5.7.15 corrected a flaw in the way error log file was handled by mysqld_safe script. The issue allows mysql system user to escalate their privileges to root, and got two CVE ids assigned - CVE-2016-6664 and CVE-2016-5617 - see bug 1386564.
The original fix was applied as part of the patch for another issue - CVE-2016-6662:
https://github.com/mysql/mysql-server/commit/684a165f28b3718160a3e4c5ebd18a465d85e97c
The fix attempted to prevent script from using touch/chown/chmod on the configured log file if it was a symbolic link. This fix was found to be incomplete and having the following issues:
- Fix was racy, and the race was quite easy to
Bugzilla
CVE-2016-5584 mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU October 2016)
bugzilla·2016-10-19·CVSS 4.4
CVE-2016-5584 [MEDIUM] CVE-2016-5584 mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU October 2016)
CVE-2016-5584 mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU October 2016)
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.5.52 and earlier, 5.6.33 and earlier and 5.7.15 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data.
External References:
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881724.html#AppendixMSQL
Discussion:
Created mariadb tracking bugs for this issue:
Affects: fedora-al
Bugzilla
CVE-2016-5617 mysql: insecure error log file handling in mysqld_safe (CPU Oct 2016)
bugzilla·2016-10-19·CVSS 7.0
CVE-2016-5617 [HIGH] CVE-2016-5617 mysql: insecure error log file handling in mysqld_safe (CPU Oct 2016)
CVE-2016-5617 mysql: insecure error log file handling in mysqld_safe (CPU Oct 2016)
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Error Handling). Supported versions that are affected are 5.5.51 and earlier, 5.6.32 and earlier and 5.7.14 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server.
Reference:
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881724.html#AppendixMSQL
Discussion:
Created mariadb tracking bugs for this issue:
Affects: fedora-all [bug 1386608]
---
Created community-mysql tracking bugs for this issue:
Affects: fedora-a
Bugzilla
CVE-2016-5616 CVE-2016-6663 mysql: race condition while setting stats during MyISAM table repair (CPU Oct 2016)
bugzilla·2016-09-23·CVSS 7.0
CVE-2016-5616 [HIGH] CVE-2016-5616 CVE-2016-6663 mysql: race condition while setting stats during MyISAM table repair (CPU Oct 2016)
CVE-2016-5616 CVE-2016-6663 mysql: race condition while setting stats during MyISAM table repair (CPU Oct 2016)
Dawid Golunski, reporter of CVE-2016-6662 (bug 1375198), mentioned existence of a privilege escalation vulnerability which should allow a non-privileged database user without FILE permissions to escalate their privileges to database or system administrator. Quoting from the advisory for CVE-2016-6662:
http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.txt
It could also be combined with CVE-2016-6663 vulnerability which will be released
shortly and could allow certain attackers to escalate their privileges to root
even without FILE privilege.
No further details are available at the moment.
Discussion:
This issue is now listed as
Bugzilla
CVE-2016-6662 mariadb: mysql: Privilege escalation by abusing MySQL logging functions [fedora-all]
bugzilla·2016-09-12·CVSS 9.8
CVE-2016-6662 [CRITICAL] CVE-2016-6662 mariadb: mysql: Privilege escalation by abusing MySQL logging functions [fedora-all]
CVE-2016-6662 mariadb: mysql: Privilege escalation by abusing MySQL logging functions [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple s
Bugzilla
CVE-2016-6662 mariadb-galera: mysql: Privilege escalation by abusing MySQL logging functions [fedora-all]
bugzilla·2016-09-12·CVSS 9.8
CVE-2016-6662 [CRITICAL] CVE-2016-6662 mariadb-galera: mysql: Privilege escalation by abusing MySQL logging functions [fedora-all]
CVE-2016-6662 mariadb-galera: mysql: Privilege escalation by abusing MySQL logging functions [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mul
Bugzilla
CVE-2016-6662 mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016)
bugzilla·2016-09-12·CVSS 9.8
CVE-2016-6662 [CRITICAL] CVE-2016-6662 mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016)
CVE-2016-6662 mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016)
A vulnerability in MySQL was found that allows:
1. injecting malicious configuration into existing MySQL configuration files on systems with weak/improper permissions (configs owned by/writable by mysql user)
2. creating new configuration files within a MySQL data directory (writable by MySQL by default) on _default_ MySQL installs without the need to rely on improper config permisions.
3. gaining access to logging functions (normally only available to MySQL admin users) to attackers with only SELECT/FILE permissions on all of the default_ MySQL installations and thus be in position to add/modify MySQL config files.
Public via:
http://seclists.org/oss-sec/2016/q3/481
Ext
Bugzilla
CVE-2016-6662 community-mysql: mysql: Privilege escalation by abusing MySQL logging functions [fedora-all]
bugzilla·2016-09-12·CVSS 9.8
CVE-2016-6662 [CRITICAL] CVE-2016-6662 community-mysql: mysql: Privilege escalation by abusing MySQL logging functions [fedora-all]
CVE-2016-6662 community-mysql: mysql: Privilege escalation by abusing MySQL logging functions [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mu
ATT&CK
Exploitation of Remote Services
mitre_attack·CVSS 9.8
[CRITICAL] Exploitation of Remote Services
Exploitation of Remote Services
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
An adversary may need to determine if the remote system is in a vulnerable state, which may be done through [Network Service Discovery](https://attack.mitre.org/techniques/T1046) or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain
ATT&CK
Exploit Public-Facing Application
mitre_attack·CVSS 9.8
[CRITICAL] Exploit Public-Facing Application
Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7169) On ESXi infrastructure, adversaries may exploit exposed OpenSLP s
http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2058.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2059.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2060.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2061.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2062.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2077.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2130.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2131.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2595.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2749.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2927.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2928.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0184.htmlhttp://seclists.org/fulldisclosure/2016/Sep/23http://www.debian.org/security/2016/dsa-3666http://www.openwall.com/lists/oss-security/2016/09/12/3http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlhttp://www.securityfocus.com/bid/92912http://www.securitytracker.com/id/1036769https://jira.mariadb.org/browse/MDEV-10465https://mariadb.com/kb/en/mariadb/mariadb-10027-release-notes/https://mariadb.com/kb/en/mariadb/mariadb-10117-release-notes/https://mariadb.com/kb/en/mariadb/mariadb-5551-release-notes/https://security.gentoo.org/glsa/201701-01https://www.exploit-db.com/exploits/40360/https://www.percona.com/blog/2016/09/12/percona-server-critical-update-cve-2016-6662/http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2058.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2059.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2060.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2061.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2062.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2077.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2130.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2131.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2595.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2749.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2927.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2928.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0184.htmlhttp://seclists.org/fulldisclosure/2016/Sep/23http://www.debian.org/security/2016/dsa-3666http://www.openwall.com/lists/oss-security/2016/09/12/3http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlhttp://www.securityfocus.com/bid/92912http://www.securitytracker.com/id/1036769https://jira.mariadb.org/browse/MDEV-10465https://mariadb.com/kb/en/mariadb/mariadb-10027-release-notes/https://mariadb.com/kb/en/mariadb/mariadb-10117-release-notes/https://mariadb.com/kb/en/mariadb/mariadb-5551-release-notes/https://security.gentoo.org/glsa/201701-01https://www.exploit-db.com/exploits/40360/https://www.percona.com/blog/2016/09/12/percona-server-critical-update-cve-2016-6662/
2016-09-20
Published
Exploited in the wild