CVE-2016-6664 mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona...
HighCVSS 7.0
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17, when using file-based logging, allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle MySQL | >= 5.5.0, <= 5.5.51 | No fix listed |
| oracle MySQL | >= 5.6.0, <= 5.6.32 | No fix listed |
| oracle MySQL | >= 5.7.0, <= 5.7.14 | No fix listed |
| MariaDB Server | >= 5.5.0, < 5.5.54 | 5.5.54 |
| MariaDB Server | >= 10.0.0, < 10.0.29 | 10.0.29 |
| MariaDB Server | >= 10.1.0, < 10.1.21 | 10.1.21 |
| percona server | >= 5.5, < 5.5.51-38.2 | 5.5.51-38.2 |
| percona server | >= 5.6, < 5.6.32-78.1 | 5.6.32-78.1 |
| percona server | >= 5.7, < 5.7.14-8 | 5.7.14-8 |
| percona xtradb cluster | >= 5.5, < 5.5.41-37.0 | 5.5.41-37.0 |
| percona xtradb cluster | >= 5.6, < 5.6.32-25.17 | 5.6.32-25.17 |
| percona xtradb cluster | >= 5.7, < 5.7.14-26.17 | 5.7.14-26.17 |
| alpine/mariadb(Alpine:v3.10) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.11) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.12) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.13) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.14) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.15) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.16) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.17) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.18) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.19) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.20) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.21) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.22) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
Show 9 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/mariadb(Alpine:v3.23) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.24) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.3) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.4) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.5) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.6) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.7) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.8) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
| alpine/mariadb(Alpine:v3.9) | >= 5.5.0, < 10.1.21-r0 | 10.1.21-r0 |
References
- legalhackers.com exploit third-party-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- RHSA-2016:2130 third-party-advisory vendor-advisory
- RHSA-2016:2749 third-party-advisory vendor-advisory
- 20161101 MySQL / MariaDB / PerconaDB - Privilege Escalation / Race Condition Exploit [CVE-2016-6663 / OCVE-2016-5616] mailing-list third-party-advisory
- DSA-3770 third-party-advisory vendor-advisory
- www.oracle.com patch vendor-advisory
- 20161104 MySQL / MariaDB / PerconaDB - Root Privilege Escalation Exploit ( CVE-2016-6664 / CVE-2016-5617 ) mailing-list third-party-advisory vdb-entry
- 93612 third-party-advisory vdb-entry
- RHSA-2017:2192 third-party-advisory vendor-advisory
- RHSA-2018:0279 third-party-advisory vendor-advisory
- RHSA-2018:0574 third-party-advisory vendor-advisory
- GLSA-201702-18 third-party-advisory vendor-advisory
- 40679 exploit third-party-advisory vdb-entry
- www.percona.com vendor-advisory
- security.alpinelinux.org vendor-advisory