Security Bulletin: IBM Security Guardium is affected by OpenSource Oracle MySQL Vulnerability (multiple CVEs)

Summary

IBM Security Guardium is affected by unspecified vulnerabilities in Oracle MySQL Server

Vulnerability Details

CVEID: CVE-2016-0503**
DESCRIPTION:** An unspecified vulnerability in Oracle MySQL Server related to the “Server: DML” component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/109978&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P)

CVEID: CVE-2016-0504**
DESCRIPTION:** An unspecified vulnerability in Oracle MySQL Server related to the “Server: DML” component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 6.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/109974&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:C)

CVEID: CVE-2016-0505**
DESCRIPTION:** An unspecified vulnerability in Oracle MySQL Server related to the “Server: Options” component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 6.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/109975&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:C)

CVEID: CVE-2016-0546**
DESCRIPTION:** An unspecified vulnerability in Oracle MySQL Server related to the Client component could allow a local attacker to execute arbitrary code on the system with elevated privileges.
CVSS Base Score: 7.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/109973&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:C/I:C/A:C)

CVEID: CVE-2016-0595**
DESCRIPTION:** An unspecified vulnerability in Oracle MySQL Server related to the “Server: DML” component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/109977&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P)

CVEID: CVE-2016-0596**
DESCRIPTION:** An unspecified vulnerability in Oracle MySQL Server related to the “Server: DML” component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/109979&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P)

CVEID: CVE-2016-0597**
DESCRIPTION:** An unspecified vulnerability in Oracle MySQL Server related to the “Server: Optimizer” component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/109981&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P)

CVEID: CVE-2016-0598**
DESCRIPTION:** An unspecified vulnerability in Oracle MySQL Server related to the “Server: DML” component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 3.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/109984&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P)

CVEID: CVE-2016-0600**
DESCRIPTION:** An unspecified vulnerability in Oracle MySQL Server related to the “Server: InnoDB” component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 3.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/109985&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P)

CVEID: CVE-2016-0606**
DESCRIPTION:** An unspecified vulnerability in Oracle MySQL Server related to the “Server: Security: Encryption” component has no confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 3.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/109989&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVEID: CVE-2016-0607**
DESCRIPTION:** An unspecified vulnerability in Oracle MySQL Server related to the “Server: Replication” component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 2.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/109991&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:M/C:N/I:N/A:P)

CVEID: CVE-2016-0608**
DESCRIPTION:** An unspecified vulnerability in Oracle MySQL Server related to the “Server: UDF” component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 3.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/109990&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P)

CVEID: CVE-2016-0609**
DESCRIPTION:** An unspecified vulnerability in Oracle MySQL Server related to the “Server: Security: Privileges” component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 1.7
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/109994&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:M/C:N/I:N/A:P)

CVEID: CVE-2016-0610**
DESCRIPTION:** An unspecified vulnerability in Oracle MySQL Server related to the “Server: InnoDB” component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 3.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/109986&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P)

CVEID: CVE-2016-0611**
DESCRIPTION:** An unspecified vulnerability in Oracle MySQL Server related to the “Server: Optimizer” component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/109982&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Affected Products and Versions

IBM Security Guardium 9.0, 9.1, 9.5, 10

Remediation/Fixes

_
VRMF_

|
APAR|
Remediation/First Fix|

—|—|—|—
IBM Security Guardium|
9x|
_PSIRT 69817 _ | http://www.ibm.com/support/fixcentral/swg/quickorder?parent=ibm%7EInformation%2BManagement&product=ibm/Information+Management/InfoSphere+Guardium&release=All&platform=All&function=fixId&fixids=SqlGuard_9.0p6019_SecurityUpdate&includeSupersedes=0&source=fc
IBM Security Guardium|
10|
_PSIRT 69817 _ | http://www.ibm.com/support/fixcentral/swg/quickorder?parent=ibm%7EInformation%2BManagement&product=ibm/Information+Management/InfoSphere+Guardium&release=All&platform=All&function=fixId&fixids=SqlGuard_10.0p6019_SecurityUpdate&includeSupersedes=0&source=fc

Workarounds and Mitigations

None