CVE-2016-6662

🗓️ 20 Sep 2016 18:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 854 Views🌐 WEB

Oracle MySQL, MariaDB, Percona Server Arbitrary Configuration Bypas

Reporter	Title	Published	Views	Family All 369
IBM Security Bulletins	Security Bulletin: MySQL 0-day exploit (CVE-2016-6662)	18 Jun 202617:57	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in mariadb affect PowerKVM	18 Jun 201801:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by Open Source Oracle MySQL Vulnerabilities (CVE-2016-6662)	16 Jun 201821:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in openssl, gnutl, mysql, kernel, glibc, ntp shipped with SmartCloud Entry Appliance	19 Jul 202000:49	–	ibm
zdt	MySQL / MariaDB / PerconaDB 5.5.52 / 5.6.33 / 5.7.15 - Code Execution / Privilege Escalation	12 Sep 201600:00	–	zdt
zdt	MySQL / MariaDB / PerconaDB - 'mysql' System User Privilege Escalation / Race Condition	2 Nov 201600:00	–	zdt
zdt	MySQL / MariaDB / PerconaDB - 'root' Privilege Escalation Vulnerability	2 Nov 201600:00	–	zdt
RedHat Linux	CVE-2016-6662	13 Mar 201813:45	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: mariadb-galera security update	13 Oct 201619:35	–	redhat
RedHat Linux	mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016)	13 Oct 201619:35	–	redhat

NVD

Node

oracle mysqlRange5.5.0–5.5.52

oracle mysqlRange5.6.0–5.6.33

oracle mysqlRange5.7.0–5.7.15

Node

percona percona_serverRange5.5–5.5.51-38.1

percona percona_serverRange5.6–5.6.32-78.0

percona percona_serverRange5.7–5.7.14-7

Node

mariadb mariadbRange5.5.20–5.5.51

mariadb mariadbRange10.0.0–10.0.27

mariadb mariadbRange10.1.0–10.1.17

Node

debian debian_linuxMatch8.0

Node

redhat openstackMatch5.0

redhat openstackMatch6.0

redhat openstackMatch7.0

redhat openstackMatch8

redhat openstackMatch9

redhat enterprise_linuxMatch7.0

redhat enterprise_linux_desktopMatch6.0

redhat enterprise_linux_desktopMatch7.0

redhat enterprise_linux_serverMatch6.0

redhat enterprise_linux_server_ausMatch7.3

redhat enterprise_linux_server_ausMatch7.4

redhat enterprise_linux_server_ausMatch7.6

redhat enterprise_linux_server_eusMatch7.3

redhat enterprise_linux_server_eusMatch7.4

redhat enterprise_linux_server_eusMatch7.5

redhat enterprise_linux_server_eusMatch7.6

redhat enterprise_linux_server_tusMatch7.3

redhat enterprise_linux_server_tusMatch7.6

redhat enterprise_linux_workstationMatch6.0

redhat enterprise_linux_workstationMatch7.0

Source	Link
oracle	www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
mariadb	www.mariadb.com/kb/en/mariadb/mariadb-10117-release-notes/
percona	www.percona.com/blog/2016/09/12/percona-server-critical-update-cve-2016-6662/
debian	www.debian.org/security/2016/dsa-3666
rhn	www.rhn.redhat.com/errata/RHSA-2016-2131.html
securityfocus	www.securityfocus.com/bid/92912
rhn	www.rhn.redhat.com/errata/RHSA-2016-2928.html
security	www.security.gentoo.org/glsa/201701-01
rhn	www.rhn.redhat.com/errata/RHSA-2016-2061.html
mariadb	www.mariadb.com/kb/en/mariadb/mariadb-5551-release-notes/

Parameter	Position	Path	Description	CWE
general_log_file	path	/etc/my.cnf	Attacker can inject malicious config entries by setting general_log_file to a system config path (e.g., /etc/my.cnf) via SQL and enabling logging.	CWE-264
general_log	path	/etc/my.cnf	Attacker can inject malicious config entries by setting general_log_file to a system config path (e.g., /etc/my.cnf) via SQL and enabling logging.	CWE-264
malloc_lib	path	/etc/my.cnf	Attacker can inject malicious config entries by setting general_log_file to a system config path (e.g., /etc/my.cnf) via SQL and enabling logging.	CWE-264
general_log_file	path	/etc/mysql/my.cnf	Same technique applied to /etc/mysql/my.cnf to inject malicious settings via general_log_file.	CWE-264
general_log	path	/etc/mysql/my.cnf	Same technique applied to /etc/mysql/my.cnf to inject malicious settings via general_log_file.	CWE-264
malloc_lib	path	/etc/mysql/my.cnf	Same technique applied to /etc/mysql/my.cnf to inject malicious settings via general_log_file.	CWE-264
general_log_file	path	SYSCONFDIR/my.cnf	Config injection targets the generic system config path SYSCONFDIR/my.cnf using general_log_file.	CWE-264
general_log	path	SYSCONFDIR/my.cnf	Config injection targets the generic system config path SYSCONFDIR/my.cnf using general_log_file.	CWE-264
malloc_lib	path	SYSCONFDIR/my.cnf	Config injection targets the generic system config path SYSCONFDIR/my.cnf using general_log_file.	CWE-264
general_log_file	path	$MYSQL_HOME/my.cnf	Attacker can point MySQL to a config file in MYSQL_HOME via general_log_file to inject payload.	CWE-264