ID CVE-2016-0647
Summary Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to FTS.
References
Vulnerable Configurations
  • openSUSE Leap 42.1
    cpe:2.3:o:opensuse:leap:42.1
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
  • Oracle Linux 7.0
    cpe:2.3:o:oracle:linux:7.0
  • Red Hat Enterprise Linux 6.0
    cpe:2.3:o:redhat:enterprise_linux:6.0
  • Red Hat Enterprise Linux (RHEL) 7.0 (7)
    cpe:2.3:o:redhat:enterprise_linux:7.0
  • IBM PowerKVM 2.1
    cpe:2.3:a:ibm:powerkvm:2.1
  • IBM PowerKVM 3.1
    cpe:2.3:a:ibm:powerkvm:3.1
  • Oracle MySQL 5.5.0
    cpe:2.3:a:oracle:mysql:5.5.0
  • Oracle MySQL 5.5.1
    cpe:2.3:a:oracle:mysql:5.5.1
  • Oracle MySQL 5.5.2
    cpe:2.3:a:oracle:mysql:5.5.2
  • Oracle MySQL 5.5.3
    cpe:2.3:a:oracle:mysql:5.5.3
  • Oracle MySQL 5.5.4
    cpe:2.3:a:oracle:mysql:5.5.4
  • Oracle MySQL 5.5.5
    cpe:2.3:a:oracle:mysql:5.5.5
  • Oracle MySQL 5.5.6
    cpe:2.3:a:oracle:mysql:5.5.6
  • Oracle MySQL 5.5.7
    cpe:2.3:a:oracle:mysql:5.5.7
  • Oracle MySQL 5.5.8
    cpe:2.3:a:oracle:mysql:5.5.8
  • Oracle MySQL 5.5.9
    cpe:2.3:a:oracle:mysql:5.5.9
  • Oracle MySQL 5.5.10
    cpe:2.3:a:oracle:mysql:5.5.10
  • Oracle MySQL 5.5.11
    cpe:2.3:a:oracle:mysql:5.5.11
  • Oracle MySQL 5.5.12
    cpe:2.3:a:oracle:mysql:5.5.12
  • Oracle MySQL 5.5.13
    cpe:2.3:a:oracle:mysql:5.5.13
  • Oracle MySQL 5.5.14
    cpe:2.3:a:oracle:mysql:5.5.14
  • Oracle MySQL 5.5.15
    cpe:2.3:a:oracle:mysql:5.5.15
  • Oracle MySQL 5.5.16
    cpe:2.3:a:oracle:mysql:5.5.16
  • Oracle MySQL 5.5.17
    cpe:2.3:a:oracle:mysql:5.5.17
  • Oracle MySQL 5.5.18
    cpe:2.3:a:oracle:mysql:5.5.18
  • Oracle MySQL 5.5.19
    cpe:2.3:a:oracle:mysql:5.5.19
  • Oracle MySQL 5.5.20
    cpe:2.3:a:oracle:mysql:5.5.20
  • Oracle MySQL 5.5.21
    cpe:2.3:a:oracle:mysql:5.5.21
  • Oracle MySQL 5.5.22
    cpe:2.3:a:oracle:mysql:5.5.22
  • Oracle MySQL 5.5.23
    cpe:2.3:a:oracle:mysql:5.5.23
  • Oracle MySQL 5.5.24
    cpe:2.3:a:oracle:mysql:5.5.24
  • Oracle MySQL 5.5.25
    cpe:2.3:a:oracle:mysql:5.5.25
  • Oracle MySQL 5.5.25a
    cpe:2.3:a:oracle:mysql:5.5.25:a
  • Oracle MySQL 5.5.26
    cpe:2.3:a:oracle:mysql:5.5.26
  • Oracle MySQL 5.5.27
    cpe:2.3:a:oracle:mysql:5.5.27
  • Oracle MySQL 5.5.28
    cpe:2.3:a:oracle:mysql:5.5.28
  • Oracle MySQL 5.5.29
    cpe:2.3:a:oracle:mysql:5.5.29
  • Oracle MySQL 5.5.30
    cpe:2.3:a:oracle:mysql:5.5.30
  • Oracle MySQL 5.5.31
    cpe:2.3:a:oracle:mysql:5.5.31
  • Oracle MySQL 5.5.32
    cpe:2.3:a:oracle:mysql:5.5.32
  • Oracle MySQL 5.5.33
    cpe:2.3:a:oracle:mysql:5.5.33
  • Oracle MySQL 5.5.34
    cpe:2.3:a:oracle:mysql:5.5.34
  • Oracle MySQL 5.5.35
    cpe:2.3:a:oracle:mysql:5.5.35
  • Oracle MySQL 5.5.36
    cpe:2.3:a:oracle:mysql:5.5.36
  • Oracle MySQL 5.5.37
    cpe:2.3:a:oracle:mysql:5.5.37
  • Oracle MySQL 5.5.38
    cpe:2.3:a:oracle:mysql:5.5.38
  • Oracle MySQL 5.5.39
    cpe:2.3:a:oracle:mysql:5.5.39
  • Oracle MySQL 5.5.40
    cpe:2.3:a:oracle:mysql:5.5.40
  • Oracle MySQL 5.5.41
    cpe:2.3:a:oracle:mysql:5.5.41
  • Oracle MySQL 5.5.42
    cpe:2.3:a:oracle:mysql:5.5.42
  • Oracle MySQL 5.5.43
    cpe:2.3:a:oracle:mysql:5.5.43
  • Oracle MySQL 5.5.44
    cpe:2.3:a:oracle:mysql:5.5.44
  • Oracle MySQL 5.5.45
    cpe:2.3:a:oracle:mysql:5.5.45
  • Oracle MySQL 5.5.46
    cpe:2.3:a:oracle:mysql:5.5.46
  • Oracle MySQL 5.5.47
    cpe:2.3:a:oracle:mysql:5.5.47
  • Oracle MySQL 5.5.48
    cpe:2.3:a:oracle:mysql:5.5.48
  • Oracle MySQL 5.6.0
    cpe:2.3:a:oracle:mysql:5.6.0
  • Oracle MySQL 5.6.1
    cpe:2.3:a:oracle:mysql:5.6.1
  • Oracle MySQL 5.6.2
    cpe:2.3:a:oracle:mysql:5.6.2
  • Oracle MySQL 5.6.3
    cpe:2.3:a:oracle:mysql:5.6.3
  • Oracle MySQL 5.6.4
    cpe:2.3:a:oracle:mysql:5.6.4
  • Oracle MySQL 5.6.5
    cpe:2.3:a:oracle:mysql:5.6.5
  • Oracle MySQL 5.6.6
    cpe:2.3:a:oracle:mysql:5.6.6
  • Oracle MySQL 5.6.7
    cpe:2.3:a:oracle:mysql:5.6.7
  • Oracle MySQL 5.6.8
    cpe:2.3:a:oracle:mysql:5.6.8
  • Oracle MySQL 5.6.9
    cpe:2.3:a:oracle:mysql:5.6.9
  • Oracle MySQL 5.6.10
    cpe:2.3:a:oracle:mysql:5.6.10
  • Oracle MySQL 5.6.11
    cpe:2.3:a:oracle:mysql:5.6.11
  • Oracle MySQL 5.6.12
    cpe:2.3:a:oracle:mysql:5.6.12
  • Oracle MySQL 5.6.13
    cpe:2.3:a:oracle:mysql:5.6.13
  • Oracle MySQL 5.6.14
    cpe:2.3:a:oracle:mysql:5.6.14
  • Oracle MySQL 5.6.15
    cpe:2.3:a:oracle:mysql:5.6.15
  • Oracle MySQL 5.6.16
    cpe:2.3:a:oracle:mysql:5.6.16
  • Oracle MySQL 5.6.17
    cpe:2.3:a:oracle:mysql:5.6.17
  • Oracle MySQL 5.6.18
    cpe:2.3:a:oracle:mysql:5.6.18
  • Oracle MySQL 5.6.19
    cpe:2.3:a:oracle:mysql:5.6.19
  • Oracle MySQL 5.6.20
    cpe:2.3:a:oracle:mysql:5.6.20
  • Oracle MySQL 5.6.21
    cpe:2.3:a:oracle:mysql:5.6.21
  • Oracle MySQL 5.6.22
    cpe:2.3:a:oracle:mysql:5.6.22
  • Oracle MySQL 5.6.23
    cpe:2.3:a:oracle:mysql:5.6.23
  • Oracle MySQL 5.6.24
    cpe:2.3:a:oracle:mysql:5.6.24
  • Oracle MySQL 5.6.25
    cpe:2.3:a:oracle:mysql:5.6.25
  • Oracle MySQL 5.6.26
    cpe:2.3:a:oracle:mysql:5.6.26
  • Oracle MySQL 5.6.27
    cpe:2.3:a:oracle:mysql:5.6.27
  • Oracle MySQL 5.6.28
    cpe:2.3:a:oracle:mysql:5.6.28
  • Oracle MySQL 5.6.29
    cpe:2.3:a:oracle:mysql:5.6.29
  • Oracle MySQL 5.7.0
    cpe:2.3:a:oracle:mysql:5.7.0
  • Oracle MySQL 5.7.0 Community Edition
    cpe:2.3:a:oracle:mysql:5.7.0:-:-:-:community
  • Oracle MySQL 5.7.0 Enterprise Edition
    cpe:2.3:a:oracle:mysql:5.7.0:-:-:-:enterprise
  • Oracle MySQL 5.7.1
    cpe:2.3:a:oracle:mysql:5.7.1
  • Oracle MySQL 5.7.2
    cpe:2.3:a:oracle:mysql:5.7.2
  • Oracle MySQL 5.7.3
    cpe:2.3:a:oracle:mysql:5.7.3
  • Oracle MySQL 5.7.4
    cpe:2.3:a:oracle:mysql:5.7.4
  • Oracle MySQL 5.7.5
    cpe:2.3:a:oracle:mysql:5.7.5
  • Oracle MySQL 5.7.6
    cpe:2.3:a:oracle:mysql:5.7.6
  • Oracle MySQL 5.7.7
    cpe:2.3:a:oracle:mysql:5.7.7
  • Oracle MySQL 5.7.8
    cpe:2.3:a:oracle:mysql:5.7.8
  • Oracle MySQL 5.7.9
    cpe:2.3:a:oracle:mysql:5.7.9
  • Oracle MySQL 5.7.10
    cpe:2.3:a:oracle:mysql:5.7.10
  • Oracle MySQL 5.7.11
    cpe:2.3:a:oracle:mysql:5.7.11
  • MariaDB 5.5.20
    cpe:2.3:a:mariadb:mariadb:5.5.20
  • MariaDB 5.5.21
    cpe:2.3:a:mariadb:mariadb:5.5.21
  • MariaDB 5.5.22
    cpe:2.3:a:mariadb:mariadb:5.5.22
  • MariaDB 5.5.23
    cpe:2.3:a:mariadb:mariadb:5.5.23
  • MariaDB 5.5.24
    cpe:2.3:a:mariadb:mariadb:5.5.24
  • MariaDB 5.5.25
    cpe:2.3:a:mariadb:mariadb:5.5.25
  • MariaDB 5.5.27
    cpe:2.3:a:mariadb:mariadb:5.5.27
  • MariaDB 5.5.28
    cpe:2.3:a:mariadb:mariadb:5.5.28
  • MariaDB 5.5.28a
    cpe:2.3:a:mariadb:mariadb:5.5.28a
  • MariaDB 5.5.33
    cpe:2.3:a:mariadb:mariadb:5.5.33
  • MariaDB 5.5.33a
    cpe:2.3:a:mariadb:mariadb:5.5.33:a
  • MariaDB 5.5.34
    cpe:2.3:a:mariadb:mariadb:5.5.34
  • MariaDB 5.5.35
    cpe:2.3:a:mariadb:mariadb:5.5.35
  • MariaDB 5.5.40
    cpe:2.3:a:mariadb:mariadb:5.5.40
  • MariaDB 5.5.43
    cpe:2.3:a:mariadb:mariadb:5.5.43
  • MariaDB 5.5.46
    cpe:2.3:a:mariadb:mariadb:5.5.46
  • MariaDB 5.5.47
    cpe:2.3:a:mariadb:mariadb:5.5.47
  • MariaDB 5.5.48
    cpe:2.3:a:mariadb:mariadb:5.5.48
  • MariaDB 10.0.0
    cpe:2.3:a:mariadb:mariadb:10.0.0
  • MariaDB 10.0.1
    cpe:2.3:a:mariadb:mariadb:10.0.1
  • MariaDB 10.0.2
    cpe:2.3:a:mariadb:mariadb:10.0.2
  • MariaDB 10.0.3
    cpe:2.3:a:mariadb:mariadb:10.0.3
  • MariaDB 10.0.4
    cpe:2.3:a:mariadb:mariadb:10.0.4
  • MariaDB 10.0.5
    cpe:2.3:a:mariadb:mariadb:10.0.5
  • MariaDB 10.0.6
    cpe:2.3:a:mariadb:mariadb:10.0.6
  • MariaDB 10.0.7
    cpe:2.3:a:mariadb:mariadb:10.0.7
  • MariaDB 10.0.8
    cpe:2.3:a:mariadb:mariadb:10.0.8
  • MariaDB 10.0.9
    cpe:2.3:a:mariadb:mariadb:10.0.9
  • MariaDB 10.0.10
    cpe:2.3:a:mariadb:mariadb:10.0.10
  • MariaDB 10.0.11
    cpe:2.3:a:mariadb:mariadb:10.0.11
  • MariaDB 10.0.12
    cpe:2.3:a:mariadb:mariadb:10.0.12
  • MariaDB 10.0.13
    cpe:2.3:a:mariadb:mariadb:10.0.13
  • MariaDB 10.0.14
    cpe:2.3:a:mariadb:mariadb:10.0.14
  • MariaDB 10.0.15
    cpe:2.3:a:mariadb:mariadb:10.0.15
  • MariaDB 10.0.16
    cpe:2.3:a:mariadb:mariadb:10.0.16
  • MariaDB 10.0.17
    cpe:2.3:a:mariadb:mariadb:10.0.17
  • MariaDB 10.0.18
    cpe:2.3:a:mariadb:mariadb:10.0.18
  • MariaDB 10.0.19
    cpe:2.3:a:mariadb:mariadb:10.0.19
  • MariaDB 10.0.20
    cpe:2.3:a:mariadb:mariadb:10.0.20
  • MariaDB 10.0.21
    cpe:2.3:a:mariadb:mariadb:10.0.21
  • MariaDB 10.0.22
    cpe:2.3:a:mariadb:mariadb:10.0.22
  • MariaDB 10.0.23
    cpe:2.3:a:mariadb:mariadb:10.0.23
  • MariaDB 10.0.24
    cpe:2.3:a:mariadb:mariadb:10.0.24
  • MariaDB 10.1.0
    cpe:2.3:a:mariadb:mariadb:10.1.0
  • MariaDB 10.1.1
    cpe:2.3:a:mariadb:mariadb:10.1.1
  • MariaDB 10.1.2
    cpe:2.3:a:mariadb:mariadb:10.1.2
  • MariaDB 10.1.3
    cpe:2.3:a:mariadb:mariadb:10.1.3
  • MariaDB 10.1.4
    cpe:2.3:a:mariadb:mariadb:10.1.4
  • MariaDB 10.1.5
    cpe:2.3:a:mariadb:mariadb:10.1.5
  • MariaDB 10.1.6
    cpe:2.3:a:mariadb:mariadb:10.1.6
  • MariaDB 10.1.7
    cpe:2.3:a:mariadb:mariadb:10.1.7
  • MariaDB 10.1.8
    cpe:2.3:a:mariadb:mariadb:10.1.8
  • MariaDB 10.1.9
    cpe:2.3:a:mariadb:mariadb:10.1.9
  • MariaDB 10.1.10
    cpe:2.3:a:mariadb:mariadb:10.1.10
  • MariaDB 10.1.11
    cpe:2.3:a:mariadb:mariadb:10.1.11
  • MariaDB 10.1.12
    cpe:2.3:a:mariadb:mariadb:10.1.12
  • MariaDB 10.1.13
    cpe:2.3:a:mariadb:mariadb:10.1.13
CVSS
Base: 4.0 (as of 07-11-2016 - 14:42)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE_INSTANCE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
nessus via4
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2016-738.NASL
    description It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via vectors related to UDF. (CVE-2016-0608) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to privileges. (CVE-2016-0609) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Options. (CVE-2016-0505) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. (CVE-2016-0600) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0616) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows remote attackers to affect confidentiality via vectors related to Server: Security: Encryption. (CVE-2016-3452) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to DDL. (CVE-2016-0644) Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Parser. (CVE-2016-3477) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0596) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0597) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect integrity and availability via vectors related to DML. (CVE-2016-0640) Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows remote authenticated users to affect availability via vectors related to Server: Types. (CVE-2016-3521) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect integrity and availability via vectors related to Federated. (CVE-2016-0642) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect confidentiality via vectors related to DML. (CVE-2016-0643) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect availability via vectors related to Security: Privileges. (CVE-2016-0666) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer. (CVE-2016-0651) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to Replication. (CVE-2016-0650) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0598) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to PS. (CVE-2016-0649) Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows remote administrators to affect availability via vectors related to Server: RBR. (CVE-2016-5440) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows remote attackers to affect confidentiality via vectors related to Server: Connection. (CVE-2016-5444) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect integrity via unknown vectors related to encryption. (CVE-2016-0606) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect availability via vectors related to PS. (CVE-2016-0648) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to DML. (CVE-2016-0646) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. (CVE-2016-0546) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect availability via vectors related to FTS. (CVE-2016-0647) Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows remote authenticated users to affect availability via vectors related to Server: DML. (CVE-2016-3615) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect confidentiality and availability via vectors related to MyISAM. (CVE-2016-0641)
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 93016
    published 2016-08-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93016
    title Amazon Linux AMI : mysql55 (ALAS-2016-738)
  • NASL family Databases
    NASL id MYSQL_5_7_12.NASL
    description The version of MySQL running on the remote host is 5.7.x prior to 5.7.12. It is, therefore, affected by multiple vulnerabilities : - A cipher algorithm downgrade vulnerability exists in the bundled version of OpenSSL due to a flaw that is triggered when handling cipher negotiation. A remote attacker can exploit this to negotiate SSLv2 ciphers and complete SSLv2 handshakes even if all SSLv2 ciphers have been disabled on the server. Note that this vulnerability only exists if the SSL_OP_NO_SSLv2 option has not been disabled. (CVE-2015-3197) - An unspecified flaw exists in the Pluggable Authentication subcomponent that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2016-0639) - An unspecified flaw exists in the Federated subcomponent that allows an authenticated, remote attacker to impact integrity and availability. (CVE-2016-0642) - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to disclose sensitive information. (CVE-2016-0643) - An unspecified flaw exists in the FTS subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0647) - An unspecified flaw exists in the PS subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0647) - An unspecified flaw exists in the InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0655) - An unspecified flaw exists in the JSON subcomponent that allows an authenticated, remote attacker to disclose sensitive information. (CVE-2016-0657) - An unspecified flaw exists in