Red Hat Bugzilla – Bug 1329238
CVE-2016-0639 mysql: unspecified vulnerability in subcomponent: Server: Pluggable Authentication (CPU April 2016)
Last modified: 2016-05-02 09:33:26 EDT
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Authentication). Supported versions that are affected are 5.6.29 and earlier and 5.7.11 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. External References: http://www.oracle.com/technetwork/topics/security/cpuapr2016-2881694.html#AppendixMSQL http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL
Reviewing commits between 5.6.29 and 5.6.30, it seems this CVE is for the following fix: https://github.com/mysql/mysql-server/commit/25d1b7e03b9b375a243fabdf0556c063c7282361 which is documented in release notes as: Integer overflow could occur during client handshake processing, leading to a server exit. (Bug #22722946) http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-30.html http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-12.html The fix prevents out of bounds read, which could cause server crash as mentioned in the release notes. Oracle CVSS scoring implies worse impact - CIA:C / CIA:H can imply code execution (e.g. if the buffer pointer that gets out of bounds is later not only read form, but also written to, leading to memory corruption), or authentication bypass (as this flaw occurs as part of the handshake packet parsing; but such impact does not seem likely). Affected code does not exist in older MySQL versions (5.5 and earlier) and MariaDB. It seems this commit introduced the main problem: https://github.com/mysql/mysql-server/commit/e2158318f55c924ce5cc40a45da56555a83b0dcb Hence version 5.6.6 and later should be affected.
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 7 Via RHSA-2016:0705 https://rhn.redhat.com/errata/RHSA-2016-0705.html