Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title MariaDB, MySQL: Root privilege escalation
Informations
Name GLSA-201711-04 First vendor Publication 2017-11-10
Vendor Gentoo Last vendor Modification 2017-11-10
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 7.2 Attack Range Local
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 3.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis


========


 


A vulnerability was discovered in MariaDB and MySQL which may allow


local users to gain root privileges.


 


Background


==========


 


MySQL is a popular multi-threaded, multi-user SQL server. MariaDB is an


enhanced, drop-in replacement for MySQL.


 


Description


===========


 


The Gentoo installation scripts before 2017-09-29 have chown calls for


user-writable directory trees, which allows local users to gain


privileges by leveraging access to the mysql account for creation of a


link.


 


Impact


======


 


A local attacker could escalate privileges to root.


 


Workaround


==========


 


There is no known workaround at this time.


 


Resolution


==========


 


All MariaDB users should upgrade to the latest version:


 



# emerge --sync



# emerge --ask --oneshot --verbose ">=dev-db/mariadb-10.0.30-r1"


 


All MySQL users should upgrade to the latest version:


 



# emerge --sync



# emerge --ask --oneshot --verbose ">=dev-db/mysql-5.6.36-r1"


 


References


==========


 


[ 1 ] CVE-2017-15945


https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-15945


 


Availability


============


 


This GLSA and any updates to it are available for viewing at


the Gentoo Security Website:


 


https://security.gentoo.org/glsa/201711-04


 


Original Source

Url : http://security.gentoo.org/glsa/glsa-201711-04.xml

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-732 Incorrect Permission Assignment for Critical Resource (CWE/SANS Top 25)

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 106
Application 9

Nessus® Vulnerability Scanner

Date Description
2017-11-13 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201711-04.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
Date Informations
2017-11-14 21:26:09
  • Multiple Updates
2017-11-14 13:24:55
  • Multiple Updates
2017-11-11 00:23:15
  • First insertion