← back
CVE-2017-3599

CVE-2017-3599

47Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 90%
from disclosure to weapon0 days
Published on NVDApr 24
1st PoCApr 18
exploitation probability
90%top 1% of all CVEs
observed exploitation
nono source reports it
4 public exploit(s)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
6 products (114 components)
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) · Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) · Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) · and others 1
fix ↗
Not affected
12 products (57 components) — because the vulnerable code is not present in the product
Red Hat Software Collections · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) · Red Hat OpenStack Platform 10 (Newton) · and others 7
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Auth). Supported versions that are affected are 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). NOTE: the previous information is from the April 2017 CPU. Oracle has not commented on third-party claims that this issue is an integer overflow in sql/auth/sql_authentication.cc which allows remote attackers to cause a denial of service via a crafted authentication packet.
Affected products
n/a · n/a
public PoCs found — 4✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/41954githubgithub.com/SECFORCE/CVE-2017-3599★ 23githubgithub.com/jptr218/mysql_dos★ 1cve_referencewww.exploit-db.com/exploits/41954/unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://access.redhat.com/errata/RHSA-2017:2787https://access.redhat.com/errata/RHSA-2017:2886https://www.exploit-db.com/exploits/41954/https://www.secforce.com/blog/2017/04/cve-2017-3599-pre-auth-mysql-remote-dos/http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.htmlhttp://www.securityfocus.com/bid/97754http://www.securitytracker.com/id/1038287