RHSA-2017:2787 - Security Advisory

Topic

An update for rh-mysql56-mysql is now available for Red Hat Software Collections.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld, and many client programs.

The following packages have been upgraded to a later upstream version: rh-mysql56-mysql (5.6.37).

Security Fix(es):

• An integer overflow flaw leading to a buffer overflow was found in the way MySQL parsed connection handshake packets. An unauthenticated remote attacker with access to the MySQL port could use this flaw to crash the mysqld daemon. (CVE-2017-3599)
• It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or tables could cause the mysql command to execute arbitrary shell or SQL commands while restoring database backup created using the mysqldump tool. (CVE-2016-5483, CVE-2017-3600)
• Multiple flaws were found in the way the MySQL init script handled initialization of the database data directory and permission setting on the error log file. The mysql operating system user could use these flaws to escalate their privileges to root. (CVE-2017-3265)
• It was discovered that the mysqld_safe script honored the ledir option value set in a MySQL configuration file. A user able to modify one of the MySQL configuration files could use this flaw to escalate their privileges to root. (CVE-2017-3291)
• It was discovered that the MySQL client command line tools only checked after authentication whether server supported SSL. A man-in-the-middle attacker could use this flaw to hijack client's authentication to the server even if the client was configured to require SSL connection. (CVE-2017-3305)
• Multiple flaws were found in the way the mysqld_safe script handled creation of error log file. The mysql operating system user could use these flaws to escalate their privileges to root. (CVE-2017-3312)
• A flaw was found in the way MySQL client library (libmysqlclient) handled prepared statements when server connection was lost. A malicious server or a man-in-the-middle attacker could possibly use this flaw to crash an application using libmysqlclient. (CVE-2017-3302)
• This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory pages listed in the References section. (CVE-2016-8327, CVE-2017-3238, CVE-2017-3244, CVE-2017-3257, CVE-2017-3258, CVE-2017-3273, CVE-2017-3308, CVE-2017-3309, CVE-2017-3313, CVE-2017-3317, CVE-2017-3318, CVE-2017-3450, CVE-2017-3452, CVE-2017-3453, CVE-2017-3456, CVE-2017-3461, CVE-2017-3462, CVE-2017-3463, CVE-2017-3464, CVE-2017-3633, CVE-2017-3634, CVE-2017-3636, CVE-2017-3641, CVE-2017-3647, CVE-2017-3648, CVE-2017-3649, CVE-2017-3651, CVE-2017-3652, CVE-2017-3653)

Red Hat would like to thank Pali Rohár for reporting CVE-2017-3305.

Bug Fix(es):

• Previously, the md5() function was blocked by MySQL in FIPS mode because the MD5 hash algorithm is considered insecure. Consequently, the mysqld daemon failed with error messages when FIPS mode was enabled. With this update, md5() is allowed in FIPS mode for non-security operations. Note that users are able to use md5() for security purposes but such usage is not supported by Red Hat. (BZ#1452469)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

Affected Products

• Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.7 x86_64
• Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.6 x86_64
• Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.5 x86_64
• Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.4 x86_64
• Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.3 x86_64
• Red Hat Software Collections (for RHEL Server) 1 for RHEL 7 x86_64
• Red Hat Software Collections (for RHEL Server) 1 for RHEL 6.7 x86_64
• Red Hat Software Collections (for RHEL Server) 1 for RHEL 6 x86_64
• Red Hat Software Collections (for RHEL Workstation) 1 for RHEL 7 x86_64
• Red Hat Software Collections (for RHEL Workstation) 1 for RHEL 6 x86_64

Fixes

• BZ - 1414133 - CVE-2017-3312 mysql: insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 fix (CPU Jan 2017)
• BZ - 1414337 - CVE-2016-8327 mysql: Server: Replication unspecified vulnerability (CPU Jan 2017)
• BZ - 1414338 - CVE-2017-3238 mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2017)
• BZ - 1414342 - CVE-2017-3244 mysql: Server: DML unspecified vulnerability (CPU Jan 2017)
• BZ - 1414350 - CVE-2017-3257 mysql: Server: InnoDB unspecified vulnerability (CPU Jan 2017)
• BZ - 1414351 - CVE-2017-3258 mysql: Server: DDL unspecified vulnerability (CPU Jan 2017)
• BZ - 1414352 - CVE-2017-3273 mysql: Server: DDL unspecified vulnerability (CPU Jan 2017)
• BZ - 1414353 - CVE-2017-3313 mysql: Server: MyISAM unspecified vulnerability (CPU Jan 2017)
• BZ - 1414355 - CVE-2017-3317 mysql: Logging unspecified vulnerability (CPU Jan 2017)
• BZ - 1414357 - CVE-2017-3318 mysql: Server: Error Handling unspecified vulnerability (CPU Jan 2017)
• BZ - 1414423 - CVE-2017-3265 mysql: unsafe chmod/chown use in init script (CPU Jan 2017)
• BZ - 1414429 - CVE-2017-3291 mysql: unrestricted mysqld_safe's ledir (CPU Jan 2017)
• BZ - 1422119 - CVE-2017-3302 mysql: prepared statement handle use-after-free after disconnect
• BZ - 1431690 - CVE-2017-3305 mysql: incorrect enforcement of ssl-mode=REQUIRED in MySQL 5.5 and 5.6
• BZ - 1433010 - CVE-2016-5483 CVE-2017-3600 mariadb, mysql: Incorrect input validation allowing code execution via mysqldump
• BZ - 1443358 - CVE-2017-3308 mysql: Server: DML unspecified vulnerability (CPU Apr 2017)
• BZ - 1443359 - CVE-2017-3309 mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017)
• BZ - 1443363 - CVE-2017-3450 mysql: Server: Memcached unspecified vulnerability (CPU Apr 2017)
• BZ - 1443364 - CVE-2017-3452 mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017)
• BZ - 1443365 - CVE-2017-3453 mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017)
• BZ - 1443369 - CVE-2017-3456 mysql: Server: DML unspecified vulnerability (CPU Apr 2017)
• BZ - 1443376 - CVE-2017-3461 mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2017)
• BZ - 1443377 - CVE-2017-3462 mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2017)
• BZ - 1443378 - CVE-2017-3463 mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2017)
• BZ - 1443379 - CVE-2017-3464 mysql: Server: DDL unspecified vulnerability (CPU Apr 2017)
• BZ - 1443386 - CVE-2017-3599 mysql: integer underflow in get_56_lenc_string() leading to DoS (CPU Apr 2017)
• BZ - 1472683 - CVE-2017-3633 mysql: Server: Memcached unspecified vulnerability (CPU Jul 2017)
• BZ - 1472684 - CVE-2017-3634 mysql: Server: DML unspecified vulnerability (CPU Jul 2017)
• BZ - 1472686 - CVE-2017-3636 mysql: Client programs unspecified vulnerability (CPU Jul 2017)
• BZ - 1472693 - CVE-2017-3641 mysql: Server: DML unspecified vulnerability (CPU Jul 2017)
• BZ - 1472703 - CVE-2017-3647 mysql: Server: Replication unspecified vulnerability (CPU Jul 2017)
• BZ - 1472704 - CVE-2017-3648 mysql: Server: Charsets unspecified vulnerability (CPU Jul 2017)
• BZ - 1472705 - CVE-2017-3649 mysql: Server: Replication unspecified vulnerability (CPU Jul 2017)
• BZ - 1472708 - CVE-2017-3651 mysql: Client mysqldump unspecified vulnerability (CPU Jul 2017)
• BZ - 1472710 - CVE-2017-3652 mysql: Server: DDL unspecified vulnerability (CPU Jul 2017)
• BZ - 1472711 - CVE-2017-3653 mysql: Server: DDL unspecified vulnerability (CPU Jul 2017)
• BZ - 1477575 - service start fails due to wrong selinux type of logfile
• BZ - 1482122 - Test case failure: /CoreOS/mysql/Regression/bz1149143-mysql-general-log-doesn-t-work-with-FIFO-file

CVEs

• CVE-2016-5483
• CVE-2016-8327
• CVE-2017-3238
• CVE-2017-3244
• CVE-2017-3257
• CVE-2017-3258
• CVE-2017-3265
• CVE-2017-3273
• CVE-2017-3291
• CVE-2017-3302
• CVE-2017-3305
• CVE-2017-3308
• CVE-2017-3309
• CVE-2017-3312
• CVE-2017-3313
• CVE-2017-3317
• CVE-2017-3318
• CVE-2017-3450
• CVE-2017-3452
• CVE-2017-3453
• CVE-2017-3456
• CVE-2017-3461
• CVE-2017-3462
• CVE-2017-3463
• CVE-2017-3464
• CVE-2017-3599
• CVE-2017-3600
• CVE-2017-3633
• CVE-2017-3634
• CVE-2017-3636
• CVE-2017-3641
• CVE-2017-3647
• CVE-2017-3648
• CVE-2017-3649
• CVE-2017-3651
• CVE-2017-3652
• CVE-2017-3653

References

• https://access.redhat.com/security/updates/classification/#important
• http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL
• http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html#AppendixMSQL
• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixMSQL
• https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-35.html
• https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-36.html
• https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-37.html