Bug 1329238 (CVE-2016-0639) - CVE-2016-0639 mysql: unspecified vulnerability in subcomponent: Server: Pluggable Authentication (CPU April 2016)
Summary: CVE-2016-0639 mysql: unspecified vulnerability in subcomponent: Server: Plugg...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-0639
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1329671 1329672
Blocks: 1329276
TreeView+ depends on / blocked
 
Reported: 2016-04-21 13:22 UTC by Adam Mariš
Modified: 2019-09-29 13:47 UTC (History)
26 users (show)

Fixed In Version: MySQL 5.6.30, MySQL 5.7.12
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-05-02 13:33:26 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:0705 normal SHIPPED_LIVE Critical: rh-mysql56-mysql security update 2016-05-02 16:36:15 UTC

Description Adam Mariš 2016-04-21 13:22:59 UTC
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Authentication). Supported versions that are affected are 5.6.29 and earlier and 5.7.11 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. 

External References:

http://www.oracle.com/technetwork/topics/security/cpuapr2016-2881694.html#AppendixMSQL
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL

Comment 1 Tomas Hoger 2016-04-22 13:40:47 UTC
Reviewing commits between 5.6.29 and 5.6.30, it seems this CVE is for the following fix:

https://github.com/mysql/mysql-server/commit/25d1b7e03b9b375a243fabdf0556c063c7282361

which is documented in release notes as:

  Integer overflow could occur during client handshake processing, leading to
  a server exit. (Bug #22722946)

http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-30.html
http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-12.html

The fix prevents out of bounds read, which could cause server crash as mentioned in the release notes.  Oracle CVSS scoring implies worse impact - CIA:C / CIA:H can imply code execution (e.g. if the buffer pointer that gets out of bounds is later not only read form, but also written to, leading to memory corruption), or authentication bypass (as this flaw occurs as part of the handshake packet parsing; but such impact does not seem likely).

Affected code does not exist in older MySQL versions (5.5 and earlier) and MariaDB.  It seems this commit introduced the main problem:

https://github.com/mysql/mysql-server/commit/e2158318f55c924ce5cc40a45da56555a83b0dcb

Hence version 5.6.6 and later should be affected.

Comment 3 errata-xmlrpc 2016-05-02 12:43:03 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2016:0705 https://rhn.redhat.com/errata/RHSA-2016-0705.html


Note You need to log in before you can comment on or make changes to this bug.