CVE-2016-6662observed exploitation

CVE-2016-6662

59Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck, has a public proof of concept and 48 threat group(s) use it.

ssvc Actepss 68%

from disclosure to weapon0 days

Published on NVDSep 20

1st PoCSep 12

VulnCheck+2793d

exploitation probability

68%top 1% of all CVEs

observed exploitation

yesVulnCheck

48 group(s)11 public exploit(s)

Who exploits it — 48

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAgrius🇮🇷APT / StateAPT28🇷🇺APT / StateAPT29🇷🇺APT / StateAPT39🇮🇷APT / StateAPT41🇨🇳APT / StateAPT5🇨🇳APT / StateAxiom🇨🇳APT / StateBackdoorDiplomacy APT / StateBlackByte APT / StateBlackTech🇨🇳APT / StateBlue Mockingbird APT / StateCinnamon Tempest🇨🇳APT / StateDragonfly🇷🇺APT / StateEarth Lusca🇨🇳APT / StateEmber Bear🇷🇺APT / StateFIN13 APT / StateFIN7 APT / StateFox Kitten🇮🇷APT / StateGALLIUM🇨🇳APT / StateGOLD SOUTHFIELD APT / StateHAFNIUM🇨🇳APT / StateINC Ransom APT / StateKe3chang🇨🇳APT / StateKimsuky🇰🇵APT / StateLeviathan🇨🇳APT / StateMagic Hound🇮🇷APT / StateMedusa Group APT / StatemenuPass🇨🇳APT / StateMirrorFace🇨🇳APT / StateMoses Staff🇮🇷APT / StateMuddyWater🇮🇷APT / StatePlay APT / StateRocke🇨🇳APT / StateSalt Typhoon🇨🇳APT / StateSandworm Team🇷🇺APT / StateSea Turtle APT / StateShinyHunters APT / StateStorm-0501 APT / StateTeamPCP APT / StateThreat Group-3390🇨🇳APT / StateToddyCat APT / StateTonto Team🇨🇳APT / StateUNC3886🇨🇳APT / StateVOID MANTICORE🇮🇷APT / StateVolatile Cedar APT / StateVolt Typhoon🇨🇳APT / StateWinter Vivern🇷🇺APT / StateWizard Spider🇷🇺

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.

Affected products

n/a · n/a

public PoCs found — 11

exploitdbwww.exploit-db.com/exploits/40360unverified githubgithub.com/MAYASEVEN/CVE-2016-6662★ 29 githubgithub.com/Ashrafdev/MySQL-Remote-Root-Code-Execution★ 9 githubgithub.com/boompig/cve-2016-6662★ 1 githubgithub.com/meersjo/ansible-mysql-cve-2016-6662★ 1 githubgithub.com/KosukeShimofuji/CVE-2016-6662★ 0 githubgithub.com/konstantin-kelemen/mysqld_safe-CVE-2016-6662-patch★ 0 vulncheckvulncheck.com/xdb/77badbece00eunverified vulncheckvulncheck.com/xdb/39e334b00224unverified vulncheckvulncheck.com/xdb/60add9bf4d4eunverified cve_referencewww.exploit-db.com/exploits/40360/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References