ID CVE-2016-2047
Summary The ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10; Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier; and Percona Server do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "/CN=" string in a field in a certificate, as demonstrated by "/OU=/CN=bar.com/CN=foo.com."
References
Vulnerable Configurations
  • MariaDB 5.5.20
    cpe:2.3:a:mariadb:mariadb:5.5.20
  • MariaDB 5.5.21
    cpe:2.3:a:mariadb:mariadb:5.5.21
  • MariaDB 5.5.22
    cpe:2.3:a:mariadb:mariadb:5.5.22
  • MariaDB 5.5.23
    cpe:2.3:a:mariadb:mariadb:5.5.23
  • MariaDB 5.5.24
    cpe:2.3:a:mariadb:mariadb:5.5.24
  • MariaDB 5.5.25
    cpe:2.3:a:mariadb:mariadb:5.5.25
  • MariaDB 5.5.27
    cpe:2.3:a:mariadb:mariadb:5.5.27
  • MariaDB 5.5.28
    cpe:2.3:a:mariadb:mariadb:5.5.28
  • MariaDB 5.5.28a
    cpe:2.3:a:mariadb:mariadb:5.5.28a
  • MariaDB 5.5.33
    cpe:2.3:a:mariadb:mariadb:5.5.33
  • MariaDB 5.5.33a
    cpe:2.3:a:mariadb:mariadb:5.5.33:a
  • MariaDB 5.5.34
    cpe:2.3:a:mariadb:mariadb:5.5.34
  • MariaDB 5.5.35
    cpe:2.3:a:mariadb:mariadb:5.5.35
  • MariaDB 5.5.40
    cpe:2.3:a:mariadb:mariadb:5.5.40
  • MariaDB 5.5.43
    cpe:2.3:a:mariadb:mariadb:5.5.43
  • MariaDB 5.5.46
    cpe:2.3:a:mariadb:mariadb:5.5.46
  • MariaDB 10.0.0
    cpe:2.3:a:mariadb:mariadb:10.0.0
  • MariaDB 10.0.1
    cpe:2.3:a:mariadb:mariadb:10.0.1
  • MariaDB 10.0.2
    cpe:2.3:a:mariadb:mariadb:10.0.2
  • MariaDB 10.0.3
    cpe:2.3:a:mariadb:mariadb:10.0.3
  • MariaDB 10.0.4
    cpe:2.3:a:mariadb:mariadb:10.0.4
  • MariaDB 10.0.5
    cpe:2.3:a:mariadb:mariadb:10.0.5
  • MariaDB 10.0.6
    cpe:2.3:a:mariadb:mariadb:10.0.6
  • MariaDB 10.0.7
    cpe:2.3:a:mariadb:mariadb:10.0.7
  • MariaDB 10.0.8
    cpe:2.3:a:mariadb:mariadb:10.0.8
  • MariaDB 10.0.9
    cpe:2.3:a:mariadb:mariadb:10.0.9
  • MariaDB 10.0.10
    cpe:2.3:a:mariadb:mariadb:10.0.10
  • MariaDB 10.0.11
    cpe:2.3:a:mariadb:mariadb:10.0.11
  • MariaDB 10.0.12
    cpe:2.3:a:mariadb:mariadb:10.0.12
  • MariaDB 10.0.13
    cpe:2.3:a:mariadb:mariadb:10.0.13
  • MariaDB 10.0.14
    cpe:2.3:a:mariadb:mariadb:10.0.14
  • MariaDB 10.0.15
    cpe:2.3:a:mariadb:mariadb:10.0.15
  • MariaDB 10.0.16
    cpe:2.3:a:mariadb:mariadb:10.0.16
  • MariaDB 10.0.17
    cpe:2.3:a:mariadb:mariadb:10.0.17
  • MariaDB 10.0.18
    cpe:2.3:a:mariadb:mariadb:10.0.18
  • MariaDB 10.0.19
    cpe:2.3:a:mariadb:mariadb:10.0.19
  • MariaDB 10.0.20
    cpe:2.3:a:mariadb:mariadb:10.0.20
  • MariaDB 10.0.21
    cpe:2.3:a:mariadb:mariadb:10.0.21
  • MariaDB 10.0.22
    cpe:2.3:a:mariadb:mariadb:10.0.22
  • MariaDB 10.1.0
    cpe:2.3:a:mariadb:mariadb:10.1.0
  • MariaDB 10.1.1
    cpe:2.3:a:mariadb:mariadb:10.1.1
  • MariaDB 10.1.2
    cpe:2.3:a:mariadb:mariadb:10.1.2
  • MariaDB 10.1.3
    cpe:2.3:a:mariadb:mariadb:10.1.3
  • MariaDB 10.1.4
    cpe:2.3:a:mariadb:mariadb:10.1.4
  • MariaDB 10.1.5
    cpe:2.3:a:mariadb:mariadb:10.1.5
  • MariaDB 10.1.6
    cpe:2.3:a:mariadb:mariadb:10.1.6
  • MariaDB 10.1.7
    cpe:2.3:a:mariadb:mariadb:10.1.7
  • MariaDB 10.1.8
    cpe:2.3:a:mariadb:mariadb:10.1.8
  • MariaDB 10.1.9
    cpe:2.3:a:mariadb:mariadb:10.1.9
  • Oracle Linux 7.0
    cpe:2.3:o:oracle:linux:7.0
  • Oracle MySQL 5.5.0
    cpe:2.3:a:oracle:mysql:5.5.0
  • Oracle MySQL 5.5.1
    cpe:2.3:a:oracle:mysql:5.5.1
  • Oracle MySQL 5.5.2
    cpe:2.3:a:oracle:mysql:5.5.2
  • Oracle MySQL 5.5.3
    cpe:2.3:a:oracle:mysql:5.5.3
  • Oracle MySQL 5.5.4
    cpe:2.3:a:oracle:mysql:5.5.4
  • Oracle MySQL 5.5.5
    cpe:2.3:a:oracle:mysql:5.5.5
  • Oracle MySQL 5.5.6
    cpe:2.3:a:oracle:mysql:5.5.6
  • Oracle MySQL 5.5.7
    cpe:2.3:a:oracle:mysql:5.5.7
  • Oracle MySQL 5.5.8
    cpe:2.3:a:oracle:mysql:5.5.8
  • Oracle MySQL 5.5.9
    cpe:2.3:a:oracle:mysql:5.5.9
  • Oracle MySQL 5.5.10
    cpe:2.3:a:oracle:mysql:5.5.10
  • Oracle MySQL 5.5.11
    cpe:2.3:a:oracle:mysql:5.5.11
  • Oracle MySQL 5.5.12
    cpe:2.3:a:oracle:mysql:5.5.12
  • Oracle MySQL 5.5.13
    cpe:2.3:a:oracle:mysql:5.5.13
  • Oracle MySQL 5.5.14
    cpe:2.3:a:oracle:mysql:5.5.14
  • Oracle MySQL 5.5.15
    cpe:2.3:a:oracle:mysql:5.5.15
  • Oracle MySQL 5.5.16
    cpe:2.3:a:oracle:mysql:5.5.16
  • Oracle MySQL 5.5.17
    cpe:2.3:a:oracle:mysql:5.5.17
  • Oracle MySQL 5.5.18
    cpe:2.3:a:oracle:mysql:5.5.18
  • Oracle MySQL 5.5.19
    cpe:2.3:a:oracle:mysql:5.5.19
  • Oracle MySQL 5.5.20
    cpe:2.3:a:oracle:mysql:5.5.20
  • Oracle MySQL 5.5.21
    cpe:2.3:a:oracle:mysql:5.5.21
  • Oracle MySQL 5.5.22
    cpe:2.3:a:oracle:mysql:5.5.22
  • Oracle MySQL 5.5.23
    cpe:2.3:a:oracle:mysql:5.5.23
  • Oracle MySQL 5.5.24
    cpe:2.3:a:oracle:mysql:5.5.24
  • Oracle MySQL 5.5.25
    cpe:2.3:a:oracle:mysql:5.5.25
  • Oracle MySQL 5.5.25a
    cpe:2.3:a:oracle:mysql:5.5.25:a
  • Oracle MySQL 5.5.26
    cpe:2.3:a:oracle:mysql:5.5.26
  • Oracle MySQL 5.5.27
    cpe:2.3:a:oracle:mysql:5.5.27
  • Oracle MySQL 5.5.28
    cpe:2.3:a:oracle:mysql:5.5.28
  • Oracle MySQL 5.5.29
    cpe:2.3:a:oracle:mysql:5.5.29
  • Oracle MySQL 5.5.30
    cpe:2.3:a:oracle:mysql:5.5.30
  • Oracle MySQL 5.5.31
    cpe:2.3:a:oracle:mysql:5.5.31
  • Oracle MySQL 5.5.32
    cpe:2.3:a:oracle:mysql:5.5.32
  • Oracle MySQL 5.5.33
    cpe:2.3:a:oracle:mysql:5.5.33
  • Oracle MySQL 5.5.34
    cpe:2.3:a:oracle:mysql:5.5.34
  • Oracle MySQL 5.5.35
    cpe:2.3:a:oracle:mysql:5.5.35
  • Oracle MySQL 5.5.36
    cpe:2.3:a:oracle:mysql:5.5.36
  • Oracle MySQL 5.5.37
    cpe:2.3:a:oracle:mysql:5.5.37
  • Oracle MySQL 5.5.38
    cpe:2.3:a:oracle:mysql:5.5.38
  • Oracle MySQL 5.5.39
    cpe:2.3:a:oracle:mysql:5.5.39
  • Oracle MySQL 5.5.40
    cpe:2.3:a:oracle:mysql:5.5.40
  • Oracle MySQL 5.5.41
    cpe:2.3:a:oracle:mysql:5.5.41
  • Oracle MySQL 5.5.42
    cpe:2.3:a:oracle:mysql:5.5.42
  • Oracle MySQL 5.5.43
    cpe:2.3:a:oracle:mysql:5.5.43
  • Oracle MySQL 5.5.44
    cpe:2.3:a:oracle:mysql:5.5.44
  • Oracle MySQL 5.5.45
    cpe:2.3:a:oracle:mysql:5.5.45
  • Oracle MySQL 5.5.46
    cpe:2.3:a:oracle:mysql:5.5.46
  • Oracle MySQL 5.5.47
    cpe:2.3:a:oracle:mysql:5.5.47
  • Oracle MySQL 5.5.48
    cpe:2.3:a:oracle:mysql:5.5.48
  • Oracle MySQL 5.6.0
    cpe:2.3:a:oracle:mysql:5.6.0
  • Oracle MySQL 5.6.1
    cpe:2.3:a:oracle:mysql:5.6.1
  • Oracle MySQL 5.6.2
    cpe:2.3:a:oracle:mysql:5.6.2
  • Oracle MySQL 5.6.3
    cpe:2.3:a:oracle:mysql:5.6.3
  • Oracle MySQL 5.6.4
    cpe:2.3:a:oracle:mysql:5.6.4
  • Oracle MySQL 5.6.5
    cpe:2.3:a:oracle:mysql:5.6.5
  • Oracle MySQL 5.6.6
    cpe:2.3:a:oracle:mysql:5.6.6
  • Oracle MySQL 5.6.7
    cpe:2.3:a:oracle:mysql:5.6.7
  • Oracle MySQL 5.6.8
    cpe:2.3:a:oracle:mysql:5.6.8
  • Oracle MySQL 5.6.9
    cpe:2.3:a:oracle:mysql:5.6.9
  • Oracle MySQL 5.6.10
    cpe:2.3:a:oracle:mysql:5.6.10
  • Oracle MySQL 5.6.11
    cpe:2.3:a:oracle:mysql:5.6.11
  • Oracle MySQL 5.6.12
    cpe:2.3:a:oracle:mysql:5.6.12
  • Oracle MySQL 5.6.13
    cpe:2.3:a:oracle:mysql:5.6.13
  • Oracle MySQL 5.6.14
    cpe:2.3:a:oracle:mysql:5.6.14
  • Oracle MySQL 5.6.15
    cpe:2.3:a:oracle:mysql:5.6.15
  • Oracle MySQL 5.6.16
    cpe:2.3:a:oracle:mysql:5.6.16
  • Oracle MySQL 5.6.17
    cpe:2.3:a:oracle:mysql:5.6.17
  • Oracle MySQL 5.6.18
    cpe:2.3:a:oracle:mysql:5.6.18
  • Oracle MySQL 5.6.19
    cpe:2.3:a:oracle:mysql:5.6.19
  • Oracle MySQL 5.6.20
    cpe:2.3:a:oracle:mysql:5.6.20
  • Oracle MySQL 5.6.21
    cpe:2.3:a:oracle:mysql:5.6.21
  • Oracle MySQL 5.6.22
    cpe:2.3:a:oracle:mysql:5.6.22
  • Oracle MySQL 5.6.23
    cpe:2.3:a:oracle:mysql:5.6.23
  • Oracle MySQL 5.6.24
    cpe:2.3:a:oracle:mysql:5.6.24
  • Oracle MySQL 5.6.25
    cpe:2.3:a:oracle:mysql:5.6.25
  • Oracle MySQL 5.6.26
    cpe:2.3:a:oracle:mysql:5.6.26
  • Oracle MySQL 5.6.27
    cpe:2.3:a:oracle:mysql:5.6.27
  • Oracle MySQL 5.6.28
    cpe:2.3:a:oracle:mysql:5.6.28
  • Oracle MySQL 5.6.29
    cpe:2.3:a:oracle:mysql:5.6.29
  • Oracle MySQL 5.7.0
    cpe:2.3:a:oracle:mysql:5.7.0
  • Oracle MySQL 5.7.0 Community Edition
    cpe:2.3:a:oracle:mysql:5.7.0:-:-:-:community
  • Oracle MySQL 5.7.0 Enterprise Edition
    cpe:2.3:a:oracle:mysql:5.7.0:-:-:-:enterprise
  • Oracle MySQL 5.7.1
    cpe:2.3:a:oracle:mysql:5.7.1
  • Oracle MySQL 5.7.2
    cpe:2.3:a:oracle:mysql:5.7.2
  • Oracle MySQL 5.7.3
    cpe:2.3:a:oracle:mysql:5.7.3
  • Oracle MySQL 5.7.4
    cpe:2.3:a:oracle:mysql:5.7.4
  • Oracle MySQL 5.7.5
    cpe:2.3:a:oracle:mysql:5.7.5
  • Oracle MySQL 5.7.6
    cpe:2.3:a:oracle:mysql:5.7.6
  • Oracle MySQL 5.7.7
    cpe:2.3:a:oracle:mysql:5.7.7
  • Oracle MySQL 5.7.8
    cpe:2.3:a:oracle:mysql:5.7.8
  • Oracle MySQL 5.7.9
    cpe:2.3:a:oracle:mysql:5.7.9
  • Oracle MySQL 5.7.10
    cpe:2.3:a:oracle:mysql:5.7.10
  • Oracle MySQL 5.7.11
    cpe:2.3:a:oracle:mysql:5.7.11
  • openSUSE Leap 42.1
    cpe:2.3:o:opensuse:leap:42.1
  • Red Hat Enterprise Linux 6.0
    cpe:2.3:o:redhat:enterprise_linux:6.0
  • Red Hat Enterprise Linux (RHEL) 7.0 (7)
    cpe:2.3:o:redhat:enterprise_linux:7.0
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
  • Debian Linux 9.0
    cpe:2.3:o:debian:debian_linux:9.0
  • Canonical Ubuntu Linux 12.04 LTS
    cpe:2.3:o:canonical:ubuntu_linux:12.04:-:-:-:lts
  • Canonical Ubuntu Linux 14.04 LTS (Long-Term Support)
    cpe:2.3:o:canonical:ubuntu_linux:14.04:-:-:-:lts
  • Canonical Ubuntu Linux 15.10
    cpe:2.3:o:canonical:ubuntu_linux:15.10
  • Canonical Ubuntu Linux 16.04 LTS (Long-Term Support)
    cpe:2.3:o:canonical:ubuntu_linux:16.04:-:-:-:lts
CVSS
Base: 4.3 (as of 17-11-2016 - 11:34)
Impact:
Exploitability:
CWE CWE-254
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
nessus via4
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2016-738.NASL
    description It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via vectors related to UDF. (CVE-2016-0608) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to privileges. (CVE-2016-0609) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Options. (CVE-2016-0505) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. (CVE-2016-0600) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0616) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows remote attackers to affect confidentiality via vectors related to Server: Security: Encryption. (CVE-2016-3452) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to DDL. (CVE-2016-0644) Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Parser. (CVE-2016-3477) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0596) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0597) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect integrity and availability via vectors related to DML. (CVE-2016-0640) Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows remote authenticated users to affect availability via vectors related to Server: Types. (CVE-2016-3521) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect integrity and availability via vectors related to Federated. (CVE-2016-0642) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect confidentiality via vectors related to DML. (CVE-2016-0643) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect availability via vectors related to Security: Privileges. (CVE-2016-0666) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer. (CVE-2016-0651) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to Replication. (CVE-2016-0650) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0598) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to PS. (CVE-2016-0649) Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows remote administrators to affect availability via vectors related to Server: RBR. (CVE-2016-5440) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows remote attackers to affect confidentiality via vectors related to Server: Connection. (CVE-2016-5444) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect integrity via unknown vectors related to encryption. (CVE-2016-0606) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect availability via vectors related to PS. (CVE-2016-0648) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to DML. (CVE-2016-0646) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. (CVE-2016-0546) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect availability via vectors related to FTS. (CVE-2016-0647) Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows remote authenticated users to affect availability via vectors related to Server: DML. (CVE-2016-3615) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect confidentiality and availability via vectors related to MyISAM. (CVE-2016-0641)
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 93016
    published 2016-08-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93016
    title Amazon Linux AMI : mysql55 (ALAS-2016-738)
  • NASL family Databases
    NASL id MYSQL_5_7_12.NASL
    description