Vulnerabilities > CVE-2017-3304 - Unspecified vulnerability in Oracle Mysql Cluster
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
NONE Integrity impact
LOW Availability impact
LOW Summary
Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: DD). Supported versions that are affected are 7.2.27 and earlier, 7.3.16 and earlier, 7.4.14 and earlier and 7.5.5 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.0 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
Vulnerable Configurations
Nessus
NASL family Databases NASL id MYSQL_CLUSTER_7_4_15.NASL description The version of MySQL Cluster running on the remote host is 7.4.x prior to 7.4.15. It is, therefore, affected by an arbitrary data manipulation vulnerability in the DD subcomponent due to an unspecified flaw. An authenticated, remote attacker can exploit this to update, insert, or delete arbitrary data or cause a partial denial of service condition. last seen 2020-06-01 modified 2020-06-02 plugin id 99519 published 2017-04-20 reporter This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/99519 title MySQL Cluster 7.4.x < 7.4.15 DD Subcomponent Arbitrary Data Manipulation (April 2017 CPU) NASL family Databases NASL id MYSQL_CLUSTER_7_5_6.NASL description The version of MySQL Cluster running on the remote host is 7.5.x prior to 7.5.6. It is, therefore, affected by an arbitrary data manipulation vulnerability in the DD subcomponent due to an unspecified flaw. An authenticated, remote attacker can exploit this to update, insert, or delete arbitrary data or cause a partial denial of service condition. last seen 2020-06-01 modified 2020-06-02 plugin id 99520 published 2017-04-20 reporter This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/99520 title MySQL Cluster 7.5.x < 7.5.6 DD Subcomponent Arbitrary Data Manipulation (April 2017 CPU) NASL family Databases NASL id MYSQL_CLUSTER_7_3_17.NASL description The version of MySQL Cluster running on the remote host is 7.3.x prior to 7.3.17. It is, therefore, affected by an arbitrary data manipulation vulnerability in the DD subcomponent due to an unspecified flaw. An authenticated, remote attacker can exploit this to update, insert, or delete arbitrary data or cause a partial denial of service condition. last seen 2020-06-01 modified 2020-06-02 plugin id 99518 published 2017-04-20 reporter This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/99518 title MySQL Cluster 7.3.x < 7.3.17 DD Subcomponent Arbitrary Data Manipulation (April 2017 CPU) NASL family Databases NASL id MYSQL_CLUSTER_7_2_28.NASL description The version of MySQL Cluster running on the remote host is 7.2.x prior to 7.2.28. It is, therefore, affected by an arbitrary data manipulation vulnerability in the DD subcomponent due to an unspecified flaw. An authenticated, remote attacker can exploit this to update, insert, or delete arbitrary data or cause a partial denial of service condition. last seen 2020-06-01 modified 2020-06-02 plugin id 99517 published 2017-04-20 reporter This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/99517 title MySQL Cluster 7.2.x < 7.2.28 DD Subcomponent Arbitrary Data Manipulation (April 2017 CPU)
References
- http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
- http://www.securityfocus.com/bid/97815
- http://www.securityfocus.com/bid/97815
- http://www.securitytracker.com/id/1038287
- http://www.securitytracker.com/id/1038287