CVE-2016-6663
MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - 'mysql' System User Privilege Escalation / Race Condition
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17 allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.
Condición de carrera en Oracle MySQL en versiones anteriores a 5.5.52, 5.6.x en versiones anteriores a 5.6.33, 5.7.x en versiones anteriores a 5.7.15 y 8.x en versiones anteriores a 8.0.1; MariaDB en versiones anteriores a 5.5.52, 10.0.x en versiones anteriores a 10.0.28 y 10.1.x en versiones anteriores a 10.1.18; Percona Server en versiones anteriores a 5.5.51-38.2, 5.6.x en versiones anteriores a 5.6.32-78-1 y 5.7.x en versiones anteriores a 5.7.14-8 y Percona XtraDB Cluster en versiones anteriores a 5.5.41-37.0, 5.6.x en versiones anteriores a 5.6.32-25.17 y 5.7.x en versiones anteriores a 5.7.14-26.17 permite a usuarios locales con ciertos permisos obtener privilegios aprovechando el uso de my_copystat por REPAIR TABLE para reparar una tabla MyISAM.
A race condition was found in the way MySQL performed MyISAM engine table repair. A database user with shell access to the server running mysqld could use this flaw to change permissions of arbitrary files writable by the mysql system user.
An independent research has revealed a race condition vulnerability which affects MySQL, MariaDB and PerconaDB databases. The vulnerability can allow a local system user with access to the affected database in the context of a low-privileged account (CREATE/INSERT/SELECT grants) to escalate their privileges and execute arbitrary code as the database system user (typically 'mysql').
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-08-10 CVE Reserved
- 2016-10-31 CVE Published
- 2016-11-02 First Exploit
- 2024-08-06 CVE Updated
- 2024-08-13 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CAPEC
References (27)
| URL | Tag | Source |
|---|---|---|
| http://seclists.org/fulldisclosure/2016/Nov/4 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2016/10/25/4 | Mailing List |
|
| http://www.securityfocus.com/bid/92911 | Third Party Advisory | |
| http://www.securityfocus.com/bid/93614 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/40678 | 2024-08-06 | |
| https://github.com/firebroo/CVE-2016-6663 | 2016-11-02 | |
| https://legalhackers.com/advisories/MySQL-Maria-Percona-PrivEscRace-CVE-2016-6663-5616-Exploit.html | 2024-08-06 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Oracle Search vendor "Oracle" | Mysql Search vendor "Oracle" for product "Mysql" | >= 5.5.0 <= 5.5.52 Search vendor "Oracle" for product "Mysql" and version " >= 5.5.0 <= 5.5.52" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Mysql Search vendor "Oracle" for product "Mysql" | >= 5.6.0 <= 5.6.33 Search vendor "Oracle" for product "Mysql" and version " >= 5.6.0 <= 5.6.33" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Mysql Search vendor "Oracle" for product "Mysql" | >= 5.7.0 <= 5.7.15 Search vendor "Oracle" for product "Mysql" and version " >= 5.7.0 <= 5.7.15" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Percona Server Search vendor "Percona" for product "Percona Server" | >= 5.5 < 5.5.51-38.2 Search vendor "Percona" for product "Percona Server" and version " >= 5.5 < 5.5.51-38.2" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Percona Server Search vendor "Percona" for product "Percona Server" | >= 5.6 < 5.6.32-78.1 Search vendor "Percona" for product "Percona Server" and version " >= 5.6 < 5.6.32-78.1" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Percona Server Search vendor "Percona" for product "Percona Server" | >= 5.7 < 5.7.14-8 Search vendor "Percona" for product "Percona Server" and version " >= 5.7 < 5.7.14-8" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Xtradb Cluster Search vendor "Percona" for product "Xtradb Cluster" | >= 5.5 < 5.5.41-37.0 Search vendor "Percona" for product "Xtradb Cluster" and version " >= 5.5 < 5.5.41-37.0" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Xtradb Cluster Search vendor "Percona" for product "Xtradb Cluster" | >= 5.6 < 5.6.32-25.17 Search vendor "Percona" for product "Xtradb Cluster" and version " >= 5.6 < 5.6.32-25.17" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Xtradb Cluster Search vendor "Percona" for product "Xtradb Cluster" | >= 5.7 < 5.7.14-26.17 Search vendor "Percona" for product "Xtradb Cluster" and version " >= 5.7 < 5.7.14-26.17" | - |
Affected
| ||||||
| Mariadb Search vendor "Mariadb" | Mariadb Search vendor "Mariadb" for product "Mariadb" | >= 5.5.20 < 5.5.52 Search vendor "Mariadb" for product "Mariadb" and version " >= 5.5.20 < 5.5.52" | - |
Affected
| ||||||
| Mariadb Search vendor "Mariadb" | Mariadb Search vendor "Mariadb" for product "Mariadb" | >= 10.0.0 < 10.0.28 Search vendor "Mariadb" for product "Mariadb" and version " >= 10.0.0 < 10.0.28" | - |
Affected
| ||||||
| Mariadb Search vendor "Mariadb" | Mariadb Search vendor "Mariadb" for product "Mariadb" | >= 10.1.0 < 10.1.18 Search vendor "Mariadb" for product "Mariadb" and version " >= 10.1.0 < 10.1.18" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Mysql Search vendor "Oracle" for product "Mysql" | 8.0 Search vendor "Oracle" for product "Mysql" and version "8.0" | - |
Affected
| ||||||