K16355 : Multiple MySQL vulnerabilities

Security Advisory Description

• CVE-2015-0382

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0381.

• CVE-2015-0381

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0382.

• CVE-2015-0391

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

• CVE-2015-0432

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DDL : Foreign Key.

• CVE-2015-0409

Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

• CVE-2014-6568

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DML.

• CVE-2015-0385

Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Pluggable Auth.

• CVE-2015-0374

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges : Foreign Key.
Impact
The CVE numbers included in this security advisory are reported to allow (through undisclosed mechanisms) a remote unauthorized attacker to perform read and write MySQL access, receive privilege escalation, or cause a denial-of-service (DoS) of the MySQL service and potentially stop critical data plane services.
However, the BIG-IP and Enterprise Manager systems have default mitigations in place through local user authentication requirements and tcp_wrappers (BIG-IP 10.x/EM 2.x) and iptables (BIG-IP 11.x/EM 3.x) that downgrade the access vector for these vulnerabilities limited to local and authenticated users.
Important: Enabling the Remote Access feature on Enterprise Manager will modify the tcp_wrappers (2.x) and iptables (3.x) rules to allow database access. As a result, the vulnerable access vector for these vulnerabilities is upgraded back to remote and unauthenticated. The Enterprise Manager Remote Access feature is disabled by default. If you have enabled the Remote Access feature, refer to theDisabling the Remote Access featureprocedure in theRecommended Actions****section.