MariaDB and MySQL CVE-2017-3302 Denial of Service Vulnerability

MariaDB and MySQL are prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause the affected application to crash, resulting in a denial-of-service condition.

Information

Bugtraq ID: 96162
Class: Failure to Handle Exceptional Conditions
CVE: CVE-2017-3302

Remote: Yes
Local: No
Published: Feb 10 2017 12:00AM
Updated: Apr 19 2017 03:04PM
Credit: pali
Vulnerable: Oracle Mysql 5.7.5
Oracle Mysql 5.7.4
Oracle Mysql 5.7.3
Oracle Mysql 5.7.2
Oracle Mysql 5.6.21
Oracle Mysql 5.6.17
Oracle Mysql 5.6.12
Oracle Mysql 5.6.11
Oracle Mysql 5.6.10
Oracle Mysql 5.6.9
Oracle Mysql 5.6.6
Oracle Mysql 5.6.5
Oracle Mysql 5.6
Oracle Mysql 5.5.54
Oracle Mysql 5.5.53
Oracle Mysql 5.5.52
Oracle Mysql 5.5.51
Oracle Mysql 5.5.50
Oracle Mysql 5.5.49
Oracle Mysql 5.5.46
Oracle Mysql 5.5.45
Oracle Mysql 5.5.44
Oracle Mysql 5.5.43
Oracle Mysql 5.5.42
Oracle Mysql 5.5.41
Oracle Mysql 5.5.40
Oracle Mysql 5.5.39
Oracle Mysql 5.5.38
Oracle Mysql 5.5.37
Oracle Mysql 5.5.36
Oracle Mysql 5.5.35
Oracle Mysql 5.5.32
Oracle Mysql 5.5.31
Oracle Mysql 5.5.28
Oracle Mysql 5.5.27
Oracle Mysql 5.5.25
Oracle Mysql 5.5.24
Oracle Mysql 5.5.23
Oracle Mysql 5.5.22
Oracle Mysql 5.5.21
Oracle Mysql 5.5.20
Oracle Mysql 5.5.19
Oracle Mysql 5.5.18
Oracle Mysql 5.5.17
Oracle Mysql 5.5.16
Oracle Mysql 5.5.15
Oracle Mysql 5.5.14
Oracle Mysql 5.5.13
Oracle Mysql 5.5.12
Oracle Mysql 5.5.11
Oracle Mysql 5.5.10
Oracle Mysql 5.1.70
Oracle Mysql 5.1.69
Oracle Mysql 5.1.66
Oracle Mysql 5.1.65
Oracle Mysql 5.1.63
Oracle Mysql 5.1.62
Oracle Mysql 5.1.61
Oracle Mysql 5.1.60
Oracle Mysql 5.1.52
Oracle Mysql 5.1.40
Oracle Mysql 5.1.32
Oracle Mysql 5.0.67
Oracle Mysql 5.0.51
Oracle Mysql 5.0.21
Oracle Mysql 5.6.8
Oracle Mysql 5.6.7
Oracle Mysql 5.6.4
Oracle Mysql 5.6.20
Oracle Mysql 5.6.2
Oracle Mysql 5.6.19
Oracle Mysql 5.6.18
Oracle Mysql 5.6.16
Oracle Mysql 5.6.15
Oracle Mysql 5.6.14
Oracle Mysql 5.6.13
Oracle Mysql 5.6.1
Oracle Mysql 5.5.48
Oracle Mysql 5.5.47
Oracle Mysql 5.5.34
Oracle Mysql 5.5.33
Oracle Mysql 5.5.30
Oracle Mysql 5.5.29
Oracle Mysql 5.5.26
Oracle Mysql 5.1.73
Oracle Mysql 5.1.72
Oracle Mysql 5.1.71
Oracle Mysql 5.1.68
Oracle Mysql 5.1.67
Oracle Mysql 5.1.64
Oracle Mysql 5.1.59
Oracle Mysql 5.1.58
Oracle Mysql 5.1.57
Oracle Mysql 5.1.56
Oracle Mysql 5.1.55
Oracle Mysql 5.1.54
Oracle Mysql 5.1.53
Oracle Mysql 5.1.51
Oracle Mysql 5.1
MariaDB MariaDB 10.1.17
MariaDB MariaDB 10.1.10
MariaDB MariaDB 10.0.27
MariaDB MariaDB 10.0.26
MariaDB MariaDB 10.0.23
MariaDB MariaDB 10.0.22
MariaDB MariaDB 5.5.54
MariaDB MariaDB 5.5.53
MariaDB MariaDB 5.5.52
MariaDB MariaDB 5.5.51
MariaDB MariaDB 5.5.50
MariaDB MariaDB 5.5.47
MariaDB MariaDB 5.5.37
MariaDB MariaDB 5.5.36
MariaDB MariaDB 5.5.29
MariaDB MariaDB 5.5.22
MariaDB MariaDB 5.5.21
MariaDB MariaDB 5.5.20
MariaDB MariaDB 5.3.11
MariaDB MariaDB 5.3.7
MariaDB MariaDB 5.3.6
MariaDB MariaDB 5.2.13
MariaDB MariaDB 5.2.11
MariaDB MariaDB 5.2.10
MariaDB MariaDB 5.2.6
MariaDB MariaDB 5.1.66
MariaDB MariaDB 5.1.61
MariaDB MariaDB 5.1.60
MariaDB MariaDB 5.1.50
MariaDB MariaDB 5.1.47
MariaDB MariaDB 5.1.44
MariaDB MariaDB 5.1.42
MariaDB MariaDB 5.1.41
MariaDB MariaDB 5.5.35
MariaDB MariaDB 5.5.34
MariaDB MariaDB 5.5.33
MariaDB MariaDB 5.5.25
MariaDB MariaDB 5.5.24
MariaDB MariaDB 5.5.23
MariaDB MariaDB 5.3.5
MariaDB MariaDB 5.3.4
MariaDB MariaDB 5.3.3
MariaDB MariaDB 5.3.2
MariaDB MariaDB 5.3.1
MariaDB MariaDB 5.3.0
MariaDB MariaDB 5.2.9
MariaDB MariaDB 5.2.8
MariaDB MariaDB 5.2.7
MariaDB MariaDB 5.2.5
MariaDB MariaDB 5.2.4
MariaDB MariaDB 5.2.3
MariaDB MariaDB 5.2.2
MariaDB MariaDB 5.2.12
MariaDB MariaDB 5.2.0
MariaDB MariaDB 5.1.62
MariaDB MariaDB 5.1.55
MariaDB MariaDB 5.1.53
MariaDB MariaDB 5.1.51
MariaDB MariaDB 5.1.49
MariaDB MariaDB 10.2.3
MariaDB MariaDB 10.2.2
MariaDB MariaDB 10.2.1
MariaDB MariaDB 10.2.0
MariaDB MariaDB 10.1.21
MariaDB MariaDB 10.0.29
MariaDB MariaDB 10.0.28
Debian Linux 6.0 sparc
Debian Linux 6.0 s/390
Debian Linux 6.0 powerpc
Debian Linux 6.0 mips
Debian Linux 6.0 ia-64
Debian Linux 6.0 ia-32
Debian Linux 6.0 arm
Debian Linux 6.0 amd64

Not Vulnerable:

References:

• BUG#17512527: LIST HANDLING INCORRECT IN MYSQL_PRUNE_STMT_LIST() (MySQL)
  
• MariaDB Homepage (Monty Program Ab)
  
• MySQL Homepage (Oracle)
  
• Use after free in libmysqlclient.so (pali)
  
• Oracle Critical Patch Update Advisory - April 2017 (Oracle)
  

Source: www.securityfocus.com