| Title | Oracle MySQL の MySQL Server における Server: C API に関する脆弱性 |
|---|---|
| Summary | Oracle MySQL の MySQL Server には、Server: C API に関する処理に不備があるため、機密性に影響のある脆弱性が存在します。 |
| Possible impacts | リモート認証されたユーザにより、情報を取得される可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | April 18, 2017, midnight |
| Registration Date | May 30, 2017, 5:06 p.m. |
| Last Update | May 30, 2017, 5:06 p.m. |
| CVSS3.0 : 警告 | |
| Score | 5.3 |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CVSS2.0 : 警告 | |
| Score | 6.3 |
|---|---|
| Vector | AV:N/AC:M/Au:S/C:C/I:N/A:N |
| オラクル |
| MySQL 5.5.55 およびそれ以前 |
| MySQL 5.6.35 およびそれ以前 |
| No | Changed Details | Date of change |
|---|---|---|
| 0 | [2017年05月30日] 掲載 |
Feb. 17, 2018, 10:37 a.m. |
| Summary | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: C API). Supported versions that are affected are 5.5.55 and earlier and 5.6.35 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). NOTE: the previous information is from the April 2017 CPU. Oracle has not commented on third-party claims that this issue allows man-in-the-middle attackers to hijack the authentication of users by leveraging incorrect ordering of security parameter verification in a client, aka, "The Riddle". |
|---|---|
| Publication Date | April 25, 2017, 4:59 a.m. |
| Registration Date | Jan. 26, 2021, 1:23 p.m. |
| Last Update | Nov. 21, 2024, 12:25 p.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* | 5.5.0 | 5.5.55 | |||
| cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* | 5.6.0 | 5.6.35 | |||
| Configuration2 | or higher | or less | more than | less than | |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | |||||