CVE-2016-6664
MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - 'root' System User Privilege Escalation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17, when using file-based logging, allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files.
mysqld_safe en Oracle MySQL hasta la versión 5.5.51, 5.6.x hasta la versión 5.6.32 y 5.7.x hasta la versión 5.7.14; MariaDB; Percona Server en versiones anteriores a 5.5.51-38.2, 5.6.x en versiones anteriores a 5.6.32-78-1 y 5.7.x en versiones anteriores a 5.7.14-8 y Percona XtraDB Cluster en versiones anteriores a 5.5.41-37.0, 5.6.x en versiones anteriores a 5.6.32-25.17 y 5.7.x en versiones anteriores a 5.7.14-26.17, cuando usa un inicio de sesión basada en archivo, permite a usuarios locales con acceso a la cuenta mysql obtener privilegios de root a través de un ataque de enlace simbólico en errores de acceso y posiblemente otros archivos.
A flaw was found in the way the mysqld_safe script handled creation of error log file. The mysql operating system user could use this flaw to escalate their privileges to root.
MySQL-based databases including MySQL, MariaDB and PerconaDB are affected by a privilege escalation vulnerability which can let attackers who have gained access to mysql system user to further escalate their privileges to root user allowing them to fully compromise the system. The vulnerability stems from unsafe file handling of error logs and other files.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-08-10 CVE Reserved
- 2016-11-02 CVE Published
- 2023-05-08 EPSS Updated
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-59: Improper Link Resolution Before File Access ('Link Following')
CAPEC
References (17)
| URL | Tag | Source |
|---|---|---|
| http://seclists.org/fulldisclosure/2016/Nov/4 | Mailing List |
|
| http://www.securityfocus.com/archive/1/539695/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/93612 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html | 2023-01-24 |
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2016-2130.html | 2023-01-24 | |
| http://rhn.redhat.com/errata/RHSA-2016-2749.html | 2023-01-24 | |
| http://www.debian.org/security/2017/dsa-3770 | 2023-01-24 | |
| https://access.redhat.com/errata/RHSA-2017:2192 | 2023-01-24 | |
| https://access.redhat.com/errata/RHSA-2018:0279 | 2023-01-24 | |
| https://access.redhat.com/errata/RHSA-2018:0574 | 2023-01-24 | |
| https://security.gentoo.org/glsa/201702-18 | 2023-01-24 | |
| https://www.percona.com/blog/2016/11/02/percona-responds-to-cve-2016-6663-and-cve-2016-6664 | 2023-01-24 | |
| https://access.redhat.com/security/cve/CVE-2016-6664 | 2018-03-21 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1386564 | 2018-03-21 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Oracle Search vendor "Oracle" | Mysql Search vendor "Oracle" for product "Mysql" | >= 5.5.0 <= 5.5.51 Search vendor "Oracle" for product "Mysql" and version " >= 5.5.0 <= 5.5.51" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Mysql Search vendor "Oracle" for product "Mysql" | >= 5.6.0 <= 5.6.32 Search vendor "Oracle" for product "Mysql" and version " >= 5.6.0 <= 5.6.32" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Mysql Search vendor "Oracle" for product "Mysql" | >= 5.7.0 <= 5.7.14 Search vendor "Oracle" for product "Mysql" and version " >= 5.7.0 <= 5.7.14" | - |
Affected
| ||||||
| Mariadb Search vendor "Mariadb" | Mariadb Search vendor "Mariadb" for product "Mariadb" | >= 5.5.0 < 5.5.54 Search vendor "Mariadb" for product "Mariadb" and version " >= 5.5.0 < 5.5.54" | - |
Affected
| ||||||
| Mariadb Search vendor "Mariadb" | Mariadb Search vendor "Mariadb" for product "Mariadb" | >= 10.0.0 < 10.0.29 Search vendor "Mariadb" for product "Mariadb" and version " >= 10.0.0 < 10.0.29" | - |
Affected
| ||||||
| Mariadb Search vendor "Mariadb" | Mariadb Search vendor "Mariadb" for product "Mariadb" | >= 10.1.0 < 10.1.21 Search vendor "Mariadb" for product "Mariadb" and version " >= 10.1.0 < 10.1.21" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Percona Server Search vendor "Percona" for product "Percona Server" | >= 5.5 < 5.5.51-38.2 Search vendor "Percona" for product "Percona Server" and version " >= 5.5 < 5.5.51-38.2" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Percona Server Search vendor "Percona" for product "Percona Server" | >= 5.6 < 5.6.32-78.1 Search vendor "Percona" for product "Percona Server" and version " >= 5.6 < 5.6.32-78.1" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Percona Server Search vendor "Percona" for product "Percona Server" | >= 5.7 < 5.7.14-8 Search vendor "Percona" for product "Percona Server" and version " >= 5.7 < 5.7.14-8" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Xtradb Cluster Search vendor "Percona" for product "Xtradb Cluster" | >= 5.5 < 5.5.41-37.0 Search vendor "Percona" for product "Xtradb Cluster" and version " >= 5.5 < 5.5.41-37.0" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Xtradb Cluster Search vendor "Percona" for product "Xtradb Cluster" | >= 5.6 < 5.6.32-25.17 Search vendor "Percona" for product "Xtradb Cluster" and version " >= 5.6 < 5.6.32-25.17" | - |
Affected
| ||||||
| Percona Search vendor "Percona" | Xtradb Cluster Search vendor "Percona" for product "Xtradb Cluster" | >= 5.7 < 5.7.14-26.17 Search vendor "Percona" for product "Xtradb Cluster" and version " >= 5.7 < 5.7.14-26.17" | - |
Affected
| ||||||