Veracode Vulnerability DatabaseVERACODE:12611Arbitrary Code Execution
6.6 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
mysql is vulnerable to arbitrary code exeuction. It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or tables could cause the mysql command to execute arbitrary shell or SQL commands while restoring database backup created using the mysqldump tool.
References
rhn.redhat.com/errata/RHSA-2016-2927.html
rhn.redhat.com/errata/RHSA-2016-2928.html
www.debian.org/security/2017/dsa-3834
www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html#AppendixMSQL
www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL
www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixMSQL
www.securityfocus.com/bid/97765
www.securitytracker.com/id/1038287
access.redhat.com/errata/RHSA-2017:2192
access.redhat.com/errata/RHSA-2017:2787
access.redhat.com/errata/RHSA-2017:2886
access.redhat.com/security/updates/classification/#important
bugzilla.redhat.com/show_bug.cgi?id=1477575
bugzilla.redhat.com/show_bug.cgi?id=1482122
dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-35.html
dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-36.html
dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-37.html
Related
6.6 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P