Vulnerability CVE-2018-2773

Vulnerability Name:

CVE-2018-2773 (CCN-141929)

Assigned:

2017-12-15

Published:

2018-04-17

Updated:

2019-10-03

Summary:

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS v3 Severity:

4.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
3.6 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): High Privileges Required (PR): High User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

4.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
3.6 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): High Privileges Required (PR): High User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

1.9 Low (CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

3.8 Low (CCN CVSS v2 Vector: AV:L/AC:H/Au:S/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): High Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

CWE-noinfo

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2018-2773

Source: CCN
Type: Oracle CPUApr2018
Oracle Critical Patch Update Advisory - April 2018

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Source: BID
Type: Third Party Advisory, VDB Entry
103811

Source: CCN
Type: BID-103811
Oracle MySQL Server CVE-2018-2773 Local Security Vulnerability

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1040698

Source: REDHAT
Type: UNKNOWN
RHSA-2018:1254

Source: REDHAT
Type: UNKNOWN
RHSA-2018:3655

Source: XF
Type: UNKNOWN
oracle-cpuapr2018-cve20182773(141929)

Source: MLIST
Type: Third Party Advisory
[debian-lts-announce] 20180419 [SECURITY] [DLA 1355-1] mysql-5.5 security update

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20180419-0002/

Source: UBUNTU
Type: Third Party Advisory
USN-3629-1

Source: UBUNTU
Type: UNKNOWN
USN-3629-2

Source: UBUNTU
Type: UNKNOWN
USN-3629-3

Source: DEBIAN
Type: Third Party Advisory
DSA-4176

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2018-2773

Vulnerable Configuration:

Configuration 1:

cpe:/a:oracle:mysql:*:*:*:*:*:*:*:* (Version >= 5.5.0 and <= 5.5.59)

OR cpe:/a:oracle:mysql:*:*:*:*:*:*:*:* (Version >= 5.6.0 and <= 5.6.39)

OR cpe:/a:oracle:mysql:*:*:*:*:*:*:*:* (Version >= 5.7.0 and <= 5.7.21)

Configuration 2:

cpe:/o:debian:debian_linux:7.0:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 3:

cpe:/o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*

OR cpe:/o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

OR cpe:/o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

Configuration CCN 1:

cpe:/a:oracle:mysql:5.5.59:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:5.6.39:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:5.7.21:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20182773	V	CVE-2018-2773	2022-05-20
oval:org.opensuse.security:def:34676	P	Security update for net-snmp (Important)	2022-01-05
oval:org.opensuse.security:def:34607	P	Security update for the Linux Kernel (Important)	2021-12-02
oval:org.opensuse.security:def:31303	P	Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)	2021-11-19
oval:org.opensuse.security:def:30267	P	Security update for MozillaFirefox (Important)	2021-11-17
oval:org.opensuse.security:def:31293	P	Security update for postgresql10 (Important)	2021-10-20
oval:org.opensuse.security:def:34568	P	Security update for python3 (Moderate)	2021-10-20
oval:org.opensuse.security:def:30124	P	Security update for Mesa (Moderate)	2021-09-16
oval:org.opensuse.security:def:31265	P	Security update for xen (Important)	2021-09-06
oval:org.opensuse.security:def:32179	P	Security update for libesmtp (Important)	2021-09-02
oval:org.opensuse.security:def:34519	P	Security update for aspell (Important)	2021-08-25
oval:org.opensuse.security:def:32140	P	Security update for MozillaFirefox (Important)	2021-07-16
oval:org.opensuse.security:def:34461	P	Security update for ucode-intel (Important)	2021-06-10
oval:org.opensuse.security:def:36231	P	libxml2-2.7.6-0.31.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:36189	P	libgdiplus0-2.6.7-0.5.76 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:33924	P	Security update for apache2-mod_auth_openidc (Important)	2021-06-08
oval:org.opensuse.security:def:30181	P	Security update for xorg-x11-server (Important)	2021-04-14
oval:org.opensuse.security:def:30036	P	Security update for the Linux Kernel (Important)	2021-03-09
oval:org.opensuse.security:def:31349	P	Security update for MozillaFirefox (Important)	2021-03-01
oval:org.opensuse.security:def:34632	P	Security update for ImageMagick (Moderate)	2021-02-19
oval:org.opensuse.security:def:35551	P	fvwm2-2.5.26-1.25 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:29831	P	Security update for jpeg (Low)	2020-12-01
oval:org.opensuse.security:def:28288	P	security update for mysql (Moderate)	2020-12-01
oval:org.opensuse.security:def:34694	P	Security update for xorg-x11-libXfixes	2020-12-01
oval:org.opensuse.security:def:35026	P	Security update for gtk2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:30583	P	Security update for ntp (Important)	2020-12-01
oval:org.opensuse.security:def:30902	P	Security update for flac	2020-12-01
oval:org.opensuse.security:def:35441	P	Security update for orca (Moderate)	2020-12-01
oval:org.opensuse.security:def:26915	P	gzip on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33830	P	Security update for gnutls (Moderate)	2020-12-01
oval:org.opensuse.security:def:27416	P	gtk2-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29819	P	Security update for IBM Java 1.6.0	2020-12-01
oval:org.opensuse.security:def:34214	P	Security update for php5 (Important)	2020-12-01
oval:org.opensuse.security:def:27615	P	Security update for Mozilla Firefox	2020-12-01
oval:org.opensuse.security:def:34790	P	Security update for SuSEfirewall2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:30525	P	Security update for jakarta-commons-fileupload	2020-12-01
oval:org.opensuse.security:def:30696	P	Security update for MozillaFirefox, MozillaFirefox-branding-SLE and mozilla-nss (Important)	2020-12-01
oval:org.opensuse.security:def:35333	P	Security update for mono-core (Moderate)	2020-12-01
oval:org.opensuse.security:def:26840	P	wireshark on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:31137	P	Security update for kvm and libvirt	2020-12-01
oval:org.opensuse.security:def:27181	P	libevent-1_4-2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:31458	P	Security update for postgresql91 (Moderate)	2020-12-01
oval:org.opensuse.security:def:34060	P	Security update for libxcrypt	2020-12-01
oval:org.opensuse.security:def:27557	P	rubygem-activesupport-3_2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29904	P	Security update for KVM	2020-12-01
oval:org.opensuse.security:def:34695	P	Security update for xorg-x11-libXp	2020-12-01
oval:org.opensuse.security:def:30421	P	Security update for xorg-x11-libXrender	2020-12-01
oval:org.opensuse.security:def:35314	P	Security update for mailman (Moderate)	2020-12-01
oval:org.opensuse.security:def:30684	P	Security update for LibVNCServer (Moderate)	2020-12-01
oval:org.opensuse.security:def:35083	P	Security update for java-1_7_0-ibm (Important)	2020-12-01
oval:org.opensuse.security:def:30627	P	Security update for Xen	2020-12-01
oval:org.opensuse.security:def:30993	P	Security update for jasper	2020-12-01
oval:org.opensuse.security:def:35480	P	Security update for php53 (Moderate)	2020-12-01
oval:org.opensuse.security:def:27043	P	tar on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:31398	P	Security update for perl (Moderate)	2020-12-01
oval:org.opensuse.security:def:33841	P	Security update for gtk2	2020-12-01
oval:org.opensuse.security:def:27469	P	libotr-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29820	P	Security update for java-1_6_0-ibm (Important)	2020-12-01
oval:org.opensuse.security:def:34303	P	Security update for quagga (Moderate)	2020-12-01
oval:org.opensuse.security:def:28253	P	Security update for libxml2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:34926	P	Security update for expat (Moderate)	2020-12-01
oval:org.opensuse.security:def:30564	P	Security update for poppler	2020-12-01
oval:org.opensuse.security:def:30770	P	Security update for augeas	2020-12-01
oval:org.opensuse.security:def:35392	P	Security update for opensc (Moderate)	2020-12-01
oval:org.opensuse.security:def:26851	P	Mesa-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33829	P	Security update for GnuTLS	2020-12-01
oval:org.opensuse.security:def:27265	P	perl-Tk on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:31502	P	Security update for python27 (Moderate)	2020-12-01
oval:org.opensuse.security:def:34157	P	Security update for openssh-openssl1 (Moderate)	2020-12-01
oval:org.opensuse.security:def:27571	P	taglib-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:34706	P	Security update for ImageMagick (Important)	2020-12-01
oval:org.opensuse.security:def:30476	P	Security update for bind (Important)	2020-12-01
oval:org.opensuse.security:def:35355	P	security update for mysql (Moderate)	2020-12-01
oval:org.opensuse.security:def:30685	P	Security update for LibVNCServer (Important)	2020-12-01
oval:org.opensuse.security:def:35173	P	Security update for krb5 (Moderate)	2020-12-01
oval:org.opensuse.security:def:26839	P	wget on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:31050	P	Security update for the Linux Kernel	2020-12-01
oval:org.opensuse.security:def:35507	P	Security update for postgresql10 (Important)	2020-12-01
oval:org.opensuse.security:def:27124	P	findutils on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:31437	P	Security update for php53 (Moderate)	2020-12-01
oval:org.opensuse.security:def:27518	P	mozilla-xulrunner192-devel on GA media (Moderate)	2020-12-01
oval:com.ubuntu.bionic:def:201827730000000	V	CVE-2018-2773 on Ubuntu 18.04 LTS (bionic) - medium.	2018-04-19
oval:com.ubuntu.xenial:def:201827730000000	V	CVE-2018-2773 on Ubuntu 16.04 LTS (xenial) - medium.	2018-04-19
oval:com.ubuntu.disco:def:201827730000000	V	CVE-2018-2773 on Ubuntu 19.04 (disco) - medium.	2018-04-19
oval:com.ubuntu.artful:def:20182773000	V	CVE-2018-2773 on Ubuntu 17.10 (artful) - medium.	2018-04-18
oval:com.ubuntu.xenial:def:20182773000	V	CVE-2018-2773 on Ubuntu 16.04 LTS (xenial) - medium.	2018-04-18
oval:com.ubuntu.bionic:def:20182773000	V	CVE-2018-2773 on Ubuntu 18.04 LTS (bionic) - medium.	2018-04-18
oval:com.ubuntu.cosmic:def:20182773000	V	CVE-2018-2773 on Ubuntu 18.10 (cosmic) - medium.	2018-04-18
oval:com.ubuntu.cosmic:def:201827730000000	V	CVE-2018-2773 on Ubuntu 18.10 (cosmic) - medium.	2018-04-18
oval:com.ubuntu.trusty:def:20182773000	V	CVE-2018-2773 on Ubuntu 14.04 LTS (trusty) - medium.	2018-04-18

BACK