CVE-2016-6662

Severity

99%

Complexity

99%

Confidentiality

165%

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.

CVSS 3.0 Base Score 9.8. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS 2.0 Base Score 9.9. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C).

Overview

First reported 8 years ago

2016-09-20 18:59:00

Last updated 5 years ago

2019-06-03 17:41:00

Affected Software

Oracle MySQL -

Debian Linux 8.0 (Jessie)

8.0

Red Hat OpenStack 5.0

5.0

Red Hat OpenStack 7.0

7.0

Red Hat Enterprise Linux (RHEL) 7.0 (7)

7.0

Red Hat Enterprise Linux Desktop 6.0

6.0

RedHat Enterprise Linux Desktop 7.0

7.0

Red Hat Enterprise Linux Server 6.0

6.0

Red Hat Enterprise Linux Advanced mission critical Update Support (AUS) 7.3

7.3

Red Hat Enterprise Linux Server Advanced mission critical Update Support (AUS) 7.4

7.4

Red Hat Enterprise Linux Server Advanced mission critical Update Support (AUS) 7.6

7.6

Red Hat Enterprise Linux Server Extended Update Support (EUS) 7.3

7.3

Red Hat Enterprise Linux Server Extended Update Support (EUS) 7.4

7.4

Red Hat Enterprise Linux Server Extended Update Support (EUS) 7.5

7.5

Red Hat Enterprise Linux Server Extended Update Support (EUS) 7.6

7.6

Red Hat Enterprise Linux Server Telecommunications Update Service (TUS) 7.6

7.6

Red Hat Enterprise Linux Workstation 6.0

6.0

RedHat Enterprise Linux Workstation 7.0

7.0

References

http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html

Third Party Advisory

RHSA-2016:2058

Third Party Advisory

RHSA-2016:2059

Third Party Advisory

RHSA-2016:2060

Third Party Advisory

RHSA-2016:2061

Third Party Advisory

RHSA-2016:2062

Third Party Advisory

RHSA-2016:2077

Third Party Advisory

RHSA-2016:2130

Third Party Advisory

RHSA-2016:2131

Third Party Advisory

RHSA-2016:2595

Third Party Advisory

RHSA-2016:2749

Third Party Advisory

RHSA-2016:2927

Third Party Advisory

RHSA-2016:2928

Third Party Advisory

RHSA-2017:0184

Third Party Advisory

20160912 CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation ( 0day )

Mailing List, Third Party Advisory

DSA-3666

Third Party Advisory

[oss-security] 20160912 CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation ( 0day )

Mailing List, Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Patch, Vendor Advisory

92912

Third Party Advisory, VDB Entry

1036769

Third Party Advisory, VDB Entry

https://jira.mariadb.org/browse/MDEV-10465

Issue Tracking, Vendor Advisory

https://mariadb.com/kb/en/mariadb/mariadb-10027-release-notes/

Release Notes, Vendor Advisory

https://mariadb.com/kb/en/mariadb/mariadb-10117-release-notes/

Release Notes, Vendor Advisory

https://mariadb.com/kb/en/mariadb/mariadb-5551-release-notes/

Release Notes, Vendor Advisory

GLSA-201701-01

Third Party Advisory

40360

Exploit, Third Party Advisory, VDB Entry

https://www.percona.com/blog/2016/09/12/percona-server-critical-update-cve-2016-6662/

Third Party Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.