Re: CVE-2016-6662 - MySQL Remote Root Code Execution / Privilege Escalation ( 0day )

[Tomas Hoger <thoger () redhat com>]

On Tue, 18 Oct 2016 22:56:18 +0200 Gsunde Orangen wrote:

> Dawid meanwhile updated his post [1] to reflect that the fixes for
> CVE-2016-6662 were added in 5.5.52/5.6.33/5.7.15.
> ... But today Oracle states that those versions were still affected
> [2], thus the fix releases are 5.5.53/5.6.34/5.7.16.

5.5.53/5.6.34/5.7.16 change the defaults for secure_file_priv - the
change that should break privilege escalation from FILE privilege to
database administrator. See upstream release notes for details.

> So which one is correct? Based on the changelogs I assume [1].

The advisory is not very explicit regarding which issue the CVE is for,
which leaves space for using it to refer to any related change.  Mitre
CVE description is more specific and says the id is for "general log
can write to my.cnf".  That description is consistent with how the id
was used by MariaDB upstream, or where Dawid's advisory says it was
fixed.

> And btw, Dawid: what happened with CVE-2016-6663? Still not public
> yet?

That CVE is now listed as fixed in MariaDB 5.5.52 and 10.1.18.  Based
on information from MariaDB upstream, the CVE is used for the race
condition issue fixed in this commit:

https://github.com/MariaDB/server/commit/347eeefbfc658c8531878218487d729f4e020805

MySQL fixed the issue in:

https://github.com/mysql/mysql-server/commit/4e5473862e6852b0f3802b0cd0c6fa10b5253291

Looking at the Oracle CPU, it seems CVE-2016-5616 is Oracle's dupe of
CVE-2016-6663.

It would be nice to have this conclusion confirmed by Oracle, but
frankly, we're unlikely to see that.  However, Dawid, as the original
reporter, can ask Oracle what CVEs they assigned to issues he reported,
and share the response.

-- 
Tomas Hoger / Red Hat Product Security