CVE-2016-6663
MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - 'mysql' System User Privilege Escalation / Race Condition
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
4Exploited in Wild
-Decision
Descriptions
Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17 allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.
Condición de carrera en Oracle MySQL en versiones anteriores a 5.5.52, 5.6.x en versiones anteriores a 5.6.33, 5.7.x en versiones anteriores a 5.7.15 y 8.x en versiones anteriores a 8.0.1; MariaDB en versiones anteriores a 5.5.52, 10.0.x en versiones anteriores a 10.0.28 y 10.1.x en versiones anteriores a 10.1.18; Percona Server en versiones anteriores a 5.5.51-38.2, 5.6.x en versiones anteriores a 5.6.32-78-1 y 5.7.x en versiones anteriores a 5.7.14-8 y Percona XtraDB Cluster en versiones anteriores a 5.5.41-37.0, 5.6.x en versiones anteriores a 5.6.32-25.17 y 5.7.x en versiones anteriores a 5.7.14-26.17 permite a usuarios locales con ciertos permisos obtener privilegios aprovechando el uso de my_copystat por REPAIR TABLE para reparar una tabla MyISAM.
A race condition was found in the way MySQL performed MyISAM engine table repair. A database user with shell access to the server running mysqld could use this flaw to change permissions of arbitrary files writable by the mysql system user.
MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is binary-compatible with MySQL. The following packages have been upgraded to a newer upstream version: rh-mariadb100-mariadb. Security Fix: It was discovered that the MariaDB logging functionality allowed writing to MariaDB configuration files. An administrative database user, or a database user with FILE privileges, could possibly use this flaw to run arbitrary commands with root privileges on the system running the database server.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-08-10 CVE Reserved
- 2016-10-31 CVE Published
- 2016-11-02 First Exploit
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CAPEC
References (28)
| URL | Tag | Source |
|---|---|---|
| http://seclists.org/fulldisclosure/2016/Nov/4 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2016/10/25/4 | Mailing List |
|
| http://www.securityfocus.com/bid/92911 | Third Party Advisory | |
| http://www.securityfocus.com/bid/93614 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/139476 | 2016-11-02 | |
| https://www.exploit-db.com/exploits/40678 | 2024-08-06 | |
| https://github.com/firebroo/CVE-2016-6663 | 2016-11-02 | |
| https://legalhackers.com/advisories/MySQL-Maria-Percona-PrivEscRace-CVE-2016-6663-5616-Exploit.html | 2024-08-06 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Oracle Search vendor "Oracle" | Mysql Search vendor "Oracle" for product "Mysql" | >= 5.5.0 <= 5.5.52 Search vendor "Oracle" for product "Mysql" and version " >= 5.5.0 <= 5.5.52" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Mysql Search vendor "Oracle" for product "Mysql" | >= 5.6.0 <= 5.6.33 Search vendor "Oracle" for product "Mysql" and version " >= 5.6.0 <= 5.6.33" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Mysql Search vendor "Oracle" for product "Mysql" | >= 5.7.0 <= 5.7.15 Search vendor "Oracle" for product "Mysql" and version " >= 5.7.0 <= 5.7.15" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Percona Server Search vendor "Percona" for product "Percona Server" | >= 5.5 < 5.5.51-38.2 Search vendor "Percona" for product "Percona Server" and version " >= 5.5 < 5.5.51-38.2" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Percona Server Search vendor "Percona" for product "Percona Server" | >= 5.6 < 5.6.32-78.1 Search vendor "Percona" for product "Percona Server" and version " >= 5.6 < 5.6.32-78.1" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Percona Server Search vendor "Percona" for product "Percona Server" | >= 5.7 < 5.7.14-8 Search vendor "Percona" for product "Percona Server" and version " >= 5.7 < 5.7.14-8" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Xtradb Cluster Search vendor "Percona" for product "Xtradb Cluster" | >= 5.5 < 5.5.41-37.0 Search vendor "Percona" for product "Xtradb Cluster" and version " >= 5.5 < 5.5.41-37.0" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Xtradb Cluster Search vendor "Percona" for product "Xtradb Cluster" | >= 5.6 < 5.6.32-25.17 Search vendor "Percona" for product "Xtradb Cluster" and version " >= 5.6 < 5.6.32-25.17" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Xtradb Cluster Search vendor "Percona" for product "Xtradb Cluster" | >= 5.7 < 5.7.14-26.17 Search vendor "Percona" for product "Xtradb Cluster" and version " >= 5.7 < 5.7.14-26.17" | - |
Affected
| ||||||
| Mariadb Search vendor "Mariadb" | Mariadb Search vendor "Mariadb" for product "Mariadb" | >= 5.5.20 < 5.5.52 Search vendor "Mariadb" for product "Mariadb" and version " >= 5.5.20 < 5.5.52" | - |
Affected
| ||||||
| Mariadb Search vendor "Mariadb" | Mariadb Search vendor "Mariadb" for product "Mariadb" | >= 10.0.0 < 10.0.28 Search vendor "Mariadb" for product "Mariadb" and version " >= 10.0.0 < 10.0.28" | - |
Affected
| ||||||
| Mariadb Search vendor "Mariadb" | Mariadb Search vendor "Mariadb" for product "Mariadb" | >= 10.1.0 < 10.1.18 Search vendor "Mariadb" for product "Mariadb" and version " >= 10.1.0 < 10.1.18" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Mysql Search vendor "Oracle" for product "Mysql" | 8.0 Search vendor "Oracle" for product "Mysql" and version "8.0" | - |
Affected
| ||||||