Bug 1329238 (CVE-2016-0639)

Summary: CVE-2016-0639 mysql: unspecified vulnerability in subcomponent: Server: Pluggable Authentication (CPU April 2016)
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: abaron, aortega, apevec, ayoung, byte, chrisw, dallan, databases-maint, dciabrin, fdinitto, gkotton, hhorak, jdornak, jorton, jschluet, jstanek, lhh, lpeer, markmc, mbayer, mmaslano, mmuzila, rbryant, sclewis, srevivo, tdecacqu
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: MySQL 5.6.30, MySQL 5.7.12 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-05-02 13:33:26 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1329671, 1329672    
Bug Blocks: 1329276    

Description Adam Mariš 2016-04-21 13:22:59 UTC 
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Authentication). Supported versions that are affected are 5.6.29 and earlier and 5.7.11 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. 

External References:

http://www.oracle.com/technetwork/topics/security/cpuapr2016-2881694.html#AppendixMSQL
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL
Comment 1 Tomas Hoger 2016-04-22 13:40:47 UTC 
Reviewing commits between 5.6.29 and 5.6.30, it seems this CVE is for the following fix:

https://github.com/mysql/mysql-server/commit/25d1b7e03b9b375a243fabdf0556c063c7282361

which is documented in release notes as:

  Integer overflow could occur during client handshake processing, leading to
  a server exit. (Bug #22722946)

http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-30.html
http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-12.html

The fix prevents out of bounds read, which could cause server crash as mentioned in the release notes.  Oracle CVSS scoring implies worse impact - CIA:C / CIA:H can imply code execution (e.g. if the buffer pointer that gets out of bounds is later not only read form, but also written to, leading to memory corruption), or authentication bypass (as this flaw occurs as part of the handshake packet parsing; but such impact does not seem likely).

Affected code does not exist in older MySQL versions (5.5 and earlier) and MariaDB.  It seems this commit introduced the main problem:

https://github.com/mysql/mysql-server/commit/e2158318f55c924ce5cc40a45da56555a83b0dcb

Hence version 5.6.6 and later should be affected.
Comment 3 errata-xmlrpc 2016-05-02 12:43:03 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2016:0705 https://rhn.redhat.com/errata/RHSA-2016-0705.html