Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2017.2404 Important: rh-mysql56-mysql security and bug fix update 22 September 2017 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: rh-mysql56-mysql Publisher: Red Hat Operating System: Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux WS/Desktop 6 Red Hat Enterprise Linux Server 7 Red Hat Enterprise Linux WS/Desktop 7 Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated Root Compromise -- Existing Account Access Privileged Data -- Remote/Unauthenticated Modify Arbitrary Files -- Remote/Unauthenticated Delete Arbitrary Files -- Remote/Unauthenticated Denial of Service -- Remote/Unauthenticated Provide Misleading Information -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2017-3653 CVE-2017-3652 CVE-2017-3651 CVE-2017-3649 CVE-2017-3648 CVE-2017-3647 CVE-2017-3641 CVE-2017-3636 CVE-2017-3634 CVE-2017-3633 CVE-2017-3600 CVE-2017-3599 CVE-2017-3464 CVE-2017-3463 CVE-2017-3462 CVE-2017-3461 CVE-2017-3456 CVE-2017-3453 CVE-2017-3452 CVE-2017-3450 CVE-2017-3318 CVE-2017-3317 CVE-2017-3313 CVE-2017-3312 CVE-2017-3309 CVE-2017-3308 CVE-2017-3305 CVE-2017-3302 CVE-2017-3291 CVE-2017-3273 CVE-2017-3265 CVE-2017-3258 CVE-2017-3257 CVE-2017-3244 CVE-2017-3238 CVE-2016-8327 CVE-2016-6664 CVE-2016-5483 Reference: ASB-2017.0109 ASB-2017.0059 Original Bulletin: https://access.redhat.com/errata/RHSA-2017:2787 - --------------------------BEGIN INCLUDED TEXT-------------------- ===================================================================== Red Hat Security Advisory Synopsis: Important: rh-mysql56-mysql security and bug fix update Advisory ID: RHSA-2017:2787-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2017:2787 Issue date: 2017-09-21 CVE Names: CVE-2016-5483 CVE-2016-8327 CVE-2017-3238 CVE-2017-3244 CVE-2017-3257 CVE-2017-3258 CVE-2017-3265 CVE-2017-3273 CVE-2017-3291 CVE-2017-3302 CVE-2017-3305 CVE-2017-3308 CVE-2017-3309 CVE-2017-3312 CVE-2017-3313 CVE-2017-3317 CVE-2017-3318 CVE-2017-3450 CVE-2017-3452 CVE-2017-3453 CVE-2017-3456 CVE-2017-3461 CVE-2017-3462 CVE-2017-3463 CVE-2017-3464 CVE-2017-3599 CVE-2017-3600 CVE-2017-3633 CVE-2017-3634 CVE-2017-3636 CVE-2017-3641 CVE-2017-3647 CVE-2017-3648 CVE-2017-3649 CVE-2017-3651 CVE-2017-3652 CVE-2017-3653 ===================================================================== 1. Summary: An update for rh-mysql56-mysql is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld, and many client programs. The following packages have been upgraded to a later upstream version: rh-mysql56-mysql (5.6.37). Security Fix(es): * An integer overflow flaw leading to a buffer overflow was found in the way MySQL parsed connection handshake packets. An unauthenticated remote attacker with access to the MySQL port could use this flaw to crash the mysqld daemon. (CVE-2017-3599) * It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or tables could cause the mysql command to execute arbitrary shell or SQL commands while restoring database backup created using the mysqldump tool. (CVE-2016-5483, CVE-2017-3600) * Multiple flaws were found in the way the MySQL init script handled initialization of the database data directory and permission setting on the error log file. The mysql operating system user could use these flaws to escalate their privileges to root. (CVE-2017-3265) * It was discovered that the mysqld_safe script honored the ledir option value set in a MySQL configuration file. A user able to modify one of the MySQL configuration files could use this flaw to escalate their privileges to root. (CVE-2017-3291) * It was discovered that the MySQL client command line tools only checked after authentication whether server supported SSL. A man-in-the-middle attacker could use this flaw to hijack client's authentication to the server even if the client was configured to require SSL connection. (CVE-2017-3305) * Multiple flaws were found in the way the mysqld_safe script handled creation of error log file. The mysql operating system user could use these flaws to escalate their privileges to root. (CVE-2017-3312) * A flaw was found in the way MySQL client library (libmysqlclient) handled prepared statements when server connection was lost. A malicious server or a man-in-the-middle attacker could possibly use this flaw to crash an application using libmysqlclient. (CVE-2017-3302) * This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory pages listed in the References section. (CVE-2016-8327, CVE-2017-3238, CVE-2017-3244, CVE-2017-3257, CVE-2017-3258, CVE-2017-3273, CVE-2017-3308, CVE-2017-3309, CVE-2017-3313, CVE-2017-3317, CVE-2017-3318, CVE-2017-3450, CVE-2017-3452, CVE-2017-3453, CVE-2017-3456, CVE-2017-3461, CVE-2017-3462, CVE-2017-3463, CVE-2017-3464, CVE-2017-3633, CVE-2017-3634, CVE-2017-3636, CVE-2017-3641, CVE-2017-3647, CVE-2017-3648, CVE-2017-3649, CVE-2017-3651, CVE-2017-3652, CVE-2017-3653) Red Hat would like to thank Pali RohA!r for reporting CVE-2017-3305. Bug Fix(es): * Previously, the md5() function was blocked by MySQL in FIPS mode because the MD5 hash algorithm is considered insecure. Consequently, the mysqld daemon failed with error messages when FIPS mode was enabled. With this update, md5() is allowed in FIPS mode for non-security operations. Note that users are able to use md5() for security purposes but such usage is not supported by Red Hat. (BZ#1452469) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the MySQL server daemon (mysqld) will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1414133 - CVE-2017-3312 mysql: insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 fix (CPU Jan 2017) 1414337 - CVE-2016-8327 mysql: Server: Replication unspecified vulnerability (CPU Jan 2017) 1414338 - CVE-2017-3238 mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2017) 1414342 - CVE-2017-3244 mysql: Server: DML unspecified vulnerability (CPU Jan 2017) 1414350 - CVE-2017-3257 mysql: Server: InnoDB unspecified vulnerability (CPU Jan 2017) 1414351 - CVE-2017-3258 mysql: Server: DDL unspecified vulnerability (CPU Jan 2017) 1414352 - CVE-2017-3273 mysql: Server: DDL unspecified vulnerability (CPU Jan 2017) 1414353 - CVE-2017-3313 mysql: Server: MyISAM unspecified vulnerability (CPU Jan 2017) 1414355 - CVE-2017-3317 mysql: Logging unspecified vulnerability (CPU Jan 2017) 1414357 - CVE-2017-3318 mysql: Server: Error Handling unspecified vulnerability (CPU Jan 2017) 1414423 - CVE-2017-3265 mysql: unsafe chmod/chown use in init script (CPU Jan 2017) 1414429 - CVE-2017-3291 mysql: unrestricted mysqld_safe's ledir (CPU Jan 2017) 1422119 - CVE-2017-3302 mysql: prepared statement handle use-after-free after disconnect 1431690 - CVE-2017-3305 mysql: incorrect enforcement of ssl-mode=REQUIRED in MySQL 5.5 and 5.6 1433010 - CVE-2016-5483 CVE-2017-3600 mariadb, mysql: Incorrect input validation allowing code execution via mysqldump 1443358 - CVE-2017-3308 mysql: Server: DML unspecified vulnerability (CPU Apr 2017) 1443359 - CVE-2017-3309 mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017) 1443363 - CVE-2017-3450 mysql: Server: Memcached unspecified vulnerability (CPU Apr 2017) 1443364 - CVE-2017-3452 mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017) 1443365 - CVE-2017-3453 mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017) 1443369 - CVE-2017-3456 mysql: Server: DML unspecified vulnerability (CPU Apr 2017) 1443376 - CVE-2017-3461 mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2017) 1443377 - CVE-2017-3462 mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2017) 1443378 - CVE-2017-3463 mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2017) 1443379 - CVE-2017-3464 mysql: Server: DDL unspecified vulnerability (CPU Apr 2017) 1443386 - CVE-2017-3599 mysql: integer underflow in get_56_lenc_string() leading to DoS (CPU Apr 2017) 1472683 - CVE-2017-3633 mysql: Server: Memcached unspecified vulnerability (CPU Jul 2017) 1472684 - CVE-2017-3634 mysql: Server: DML unspecified vulnerability (CPU Jul 2017) 1472686 - CVE-2017-3636 mysql: Client programs unspecified vulnerability (CPU Jul 2017) 1472693 - CVE-2017-3641 mysql: Server: DML unspecified vulnerability (CPU Jul 2017) 1472703 - CVE-2017-3647 mysql: Server: Replication unspecified vulnerability (CPU Jul 2017) 1472704 - CVE-2017-3648 mysql: Server: Charsets unspecified vulnerability (CPU Jul 2017) 1472705 - CVE-2017-3649 mysql: Server: Replication unspecified vulnerability (CPU Jul 2017) 1472708 - CVE-2017-3651 mysql: Client mysqldump unspecified vulnerability (CPU Jul 2017) 1472710 - CVE-2017-3652 mysql: Server: DDL unspecified vulnerability (CPU Jul 2017) 1472711 - CVE-2017-3653 mysql: Server: DDL unspecified vulnerability (CPU Jul 2017) 1477575 - service start fails due to wrong selinux type of logfile 1482122 - Test case failure: /CoreOS/mysql/Regression/bz1149143-mysql-general-log-doesn-t-work-with-FIFO-file 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6): Source: rh-mysql56-mysql-5.6.37-5.el6.src.rpm x86_64: rh-mysql56-mysql-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-bench-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-common-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-config-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-debuginfo-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-devel-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-errmsg-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-server-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-test-5.6.37-5.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7): Source: rh-mysql56-mysql-5.6.37-5.el6.src.rpm x86_64: rh-mysql56-mysql-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-bench-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-common-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-config-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-debuginfo-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-devel-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-errmsg-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-server-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-test-5.6.37-5.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: rh-mysql56-mysql-5.6.37-5.el6.src.rpm x86_64: rh-mysql56-mysql-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-bench-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-common-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-config-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-debuginfo-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-devel-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-errmsg-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-server-5.6.37-5.el6.x86_64.rpm rh-mysql56-mysql-test-5.6.37-5.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-mysql56-mysql-5.6.37-5.el7.src.rpm x86_64: rh-mysql56-mysql-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-bench-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-common-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-config-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-debuginfo-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-devel-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-errmsg-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-server-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-test-5.6.37-5.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3): Source: rh-mysql56-mysql-5.6.37-5.el7.src.rpm x86_64: rh-mysql56-mysql-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-bench-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-common-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-config-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-debuginfo-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-devel-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-errmsg-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-server-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-test-5.6.37-5.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-mysql56-mysql-5.6.37-5.el7.src.rpm x86_64: rh-mysql56-mysql-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-bench-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-common-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-config-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-debuginfo-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-devel-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-errmsg-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-server-5.6.37-5.el7.x86_64.rpm rh-mysql56-mysql-test-5.6.37-5.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-5483 https://access.redhat.com/security/cve/CVE-2016-8327 https://access.redhat.com/security/cve/CVE-2017-3238 https://access.redhat.com/security/cve/CVE-2017-3244 https://access.redhat.com/security/cve/CVE-2017-3257 https://access.redhat.com/security/cve/CVE-2017-3258 https://access.redhat.com/security/cve/CVE-2017-3265 https://access.redhat.com/security/cve/CVE-2017-3273 https://access.redhat.com/security/cve/CVE-2017-3291 https://access.redhat.com/security/cve/CVE-2017-3302 https://access.redhat.com/security/cve/CVE-2017-3305 https://access.redhat.com/security/cve/CVE-2017-3308 https://access.redhat.com/security/cve/CVE-2017-3309 https://access.redhat.com/security/cve/CVE-2017-3312 https://access.redhat.com/security/cve/CVE-2017-3313 https://access.redhat.com/security/cve/CVE-2017-3317 https://access.redhat.com/security/cve/CVE-2017-3318 https://access.redhat.com/security/cve/CVE-2017-3450 https://access.redhat.com/security/cve/CVE-2017-3452 https://access.redhat.com/security/cve/CVE-2017-3453 https://access.redhat.com/security/cve/CVE-2017-3456 https://access.redhat.com/security/cve/CVE-2017-3461 https://access.redhat.com/security/cve/CVE-2017-3462 https://access.redhat.com/security/cve/CVE-2017-3463 https://access.redhat.com/security/cve/CVE-2017-3464 https://access.redhat.com/security/cve/CVE-2017-3599 https://access.redhat.com/security/cve/CVE-2017-3600 https://access.redhat.com/security/cve/CVE-2017-3633 https://access.redhat.com/security/cve/CVE-2017-3634 https://access.redhat.com/security/cve/CVE-2017-3636 https://access.redhat.com/security/cve/CVE-2017-3641 https://access.redhat.com/security/cve/CVE-2017-3647 https://access.redhat.com/security/cve/CVE-2017-3648 https://access.redhat.com/security/cve/CVE-2017-3649 https://access.redhat.com/security/cve/CVE-2017-3651 https://access.redhat.com/security/cve/CVE-2017-3652 https://access.redhat.com/security/cve/CVE-2017-3653 https://access.redhat.com/security/updates/classification/#important http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html#AppendixMSQL http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixMSQL https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-35.html https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-36.html https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-37.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWcRWZIx+lLeg9Ub1AQhGQg/9G7OdBdxgCMbHkvwvvYD7hR0ysqulMy9v 5Hd+hSusn4yoDTJLfZDWhfP6CGeI03d+lTLulIxM+r+nhdO5c7jMNh8ddh/cDlg5 H+D3xaSOASL29uvfjSaL3/aX3TPrbGSwztMJE3hwvJJB9PbiaBKZIf+oGGzkYuno 57MjOleJnXRoEagqdysduoLXnqt4xXT8sYIrMdECs/u9nH17vUykdv0444DaqnAj TlMe4GEd4JYL2LOzsX8oYG+Z2E9M6a7gKc43sgXhd9GHWn4g7TuZyMX8dNofhpGC 8equxKCSCMrmQWZLuogBQ5H/Lp7kaRPsTfxMlUjizvoPJ5fbrXYuDcMWtEgmEkmt wRLBWQDbSJw93kk9otBz2/tPSCvTQ58KLy2DvJuvzMetqpa3/9HdFGbHUNSGyLzt u+OuAcFFpJnv3Wib9+SQlJg2uXSRNsujp0Q4qcxsE5Rd6Mezg4gvExF/JMcmc2TN Rox1UE0dvKBMd6GhTrUHWgcKqry1rk38tarcJg6HYNBHwIeFrRKLzBrx1viWC195 lEmfdISC7LPfpb+FC4W0l3/7fiOucC+fuuzYtgVc6MswqvmLqPBveAewug1Hdmiy g0OAcbCx9UB3qUIJMuUACO4276MPGO8og+RDlOKpTexRir8V8GgURHX3rPX53bxb CErIvOZE+W0= =sf+Q -----END PGP SIGNATURE-----