Vulnerability CVE-2018-2818

Vulnerability Name:

CVE-2018-2818 (CCN-141974)

Assigned:

2017-12-15

Published:

2018-04-17

Updated:

2019-10-03

Summary:

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS v3 Severity:

4.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
4.3 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): High User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

4.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
4.3 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): High User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

CWE-noinfo

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2018-2818

Source: CCN
Type: Oracle CPUApr2018
Oracle Critical Patch Update Advisory - April 2018

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Source: BID
Type: Third Party Advisory, VDB Entry
103824

Source: CCN
Type: BID-103824
Oracle MySQL Server CVE-2018-2818 Remote Security Vulnerability

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1040698

Source: REDHAT
Type: Third Party Advisory
RHSA-2018:1254

Source: REDHAT
Type: Third Party Advisory
RHSA-2018:3655

Source: XF
Type: UNKNOWN
oracle-cpuapr2018-cve20182818(141974)

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20180419 [SECURITY] [DLA 1355-1] mysql-5.5 security update

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20180419-0002/

Source: UBUNTU
Type: Third Party Advisory
USN-3629-1

Source: UBUNTU
Type: Third Party Advisory
USN-3629-2

Source: UBUNTU
Type: Third Party Advisory
USN-3629-3

Source: DEBIAN
Type: Third Party Advisory
DSA-4176

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2018-2818

Vulnerable Configuration:

Configuration 1:

cpe:/a:oracle:mysql:*:*:*:*:*:*:*:* (Version >= 5.5.0 and <= 5.5.59)

OR cpe:/a:oracle:mysql:*:*:*:*:*:*:*:* (Version >= 5.6.0 and <= 5.6.39)

OR cpe:/a:oracle:mysql:*:*:*:*:*:*:*:* (Version >= 5.7.0 and <= 5.7.21)

Configuration 2:

cpe:/o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*

OR cpe:/o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

OR cpe:/o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

OR cpe:/o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*

OR cpe:/o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Configuration 3:

cpe:/o:debian:debian_linux:7.0:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 4:

cpe:/a:netapp:oncommand_insight:-:*:*:*:*:*:*:*

OR cpe:/a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:* (Version >= 7.3

OR cpe:/a:netapp:oncommand_unified_manager:*:*:*:*:*:vsphere:*:* (Version >= 9.4

OR cpe:/a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*

OR cpe:/a:netapp:snapcenter:-:*:*:*:*:*:*:*

OR cpe:/a:netapp:storage_automation_store:-:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:oracle:mysql:5.5.59:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:5.6.39:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql:5.7.21:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20182818	V	CVE-2018-2818	2022-05-20
oval:org.opensuse.security:def:34676	P	Security update for net-snmp (Important)	2022-01-05
oval:org.opensuse.security:def:34607	P	Security update for the Linux Kernel (Important)	2021-12-02
oval:org.opensuse.security:def:31303	P	Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)	2021-11-19
oval:org.opensuse.security:def:30267	P	Security update for MozillaFirefox (Important)	2021-11-17
oval:org.opensuse.security:def:31293	P	Security update for postgresql10 (Important)	2021-10-20
oval:org.opensuse.security:def:34568	P	Security update for python3 (Moderate)	2021-10-20
oval:org.opensuse.security:def:30124	P	Security update for Mesa (Moderate)	2021-09-16
oval:org.opensuse.security:def:31265	P	Security update for xen (Important)	2021-09-06
oval:org.opensuse.security:def:32179	P	Security update for libesmtp (Important)	2021-09-02
oval:org.opensuse.security:def:34519	P	Security update for aspell (Important)	2021-08-25
oval:org.opensuse.security:def:32140	P	Security update for MozillaFirefox (Important)	2021-07-16
oval:org.opensuse.security:def:34461	P	Security update for ucode-intel (Important)	2021-06-10
oval:org.opensuse.security:def:36231	P	libxml2-2.7.6-0.31.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:36189	P	libgdiplus0-2.6.7-0.5.76 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:33924	P	Security update for apache2-mod_auth_openidc (Important)	2021-06-08
oval:org.opensuse.security:def:30181	P	Security update for xorg-x11-server (Important)	2021-04-14
oval:org.opensuse.security:def:30036	P	Security update for the Linux Kernel (Important)	2021-03-09
oval:org.opensuse.security:def:31349	P	Security update for MozillaFirefox (Important)	2021-03-01
oval:org.opensuse.security:def:34632	P	Security update for ImageMagick (Moderate)	2021-02-19
oval:org.opensuse.security:def:35551	P	fvwm2-2.5.26-1.25 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:29831	P	Security update for jpeg (Low)	2020-12-01
oval:org.opensuse.security:def:28288	P	security update for mysql (Moderate)	2020-12-01
oval:org.opensuse.security:def:34694	P	Security update for xorg-x11-libXfixes	2020-12-01
oval:org.opensuse.security:def:35026	P	Security update for gtk2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:30583	P	Security update for ntp (Important)	2020-12-01
oval:org.opensuse.security:def:30902	P	Security update for flac	2020-12-01
oval:org.opensuse.security:def:35441	P	Security update for orca (Moderate)	2020-12-01
oval:org.opensuse.security:def:26915	P	gzip on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33830	P	Security update for gnutls (Moderate)	2020-12-01
oval:org.opensuse.security:def:27416	P	gtk2-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29819	P	Security update for IBM Java 1.6.0	2020-12-01
oval:org.opensuse.security:def:34214	P	Security update for php5 (Important)	2020-12-01
oval:org.opensuse.security:def:27615	P	Security update for Mozilla Firefox	2020-12-01
oval:org.opensuse.security:def:34790	P	Security update for SuSEfirewall2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:30525	P	Security update for jakarta-commons-fileupload	2020-12-01
oval:org.opensuse.security:def:30696	P	Security update for MozillaFirefox, MozillaFirefox-branding-SLE and mozilla-nss (Important)	2020-12-01
oval:org.opensuse.security:def:35333	P	Security update for mono-core (Moderate)	2020-12-01
oval:org.opensuse.security:def:26840	P	wireshark on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:31137	P	Security update for kvm and libvirt	2020-12-01
oval:org.opensuse.security:def:27181	P	libevent-1_4-2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:31458	P	Security update for postgresql91 (Moderate)	2020-12-01
oval:org.opensuse.security:def:34060	P	Security update for libxcrypt	2020-12-01
oval:org.opensuse.security:def:27557	P	rubygem-activesupport-3_2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29904	P	Security update for KVM	2020-12-01
oval:org.opensuse.security:def:34695	P	Security update for xorg-x11-libXp	2020-12-01
oval:org.opensuse.security:def:30421	P	Security update for xorg-x11-libXrender	2020-12-01
oval:org.opensuse.security:def:35314	P	Security update for mailman (Moderate)	2020-12-01
oval:org.opensuse.security:def:30684	P	Security update for LibVNCServer (Moderate)	2020-12-01
oval:org.opensuse.security:def:35083	P	Security update for java-1_7_0-ibm (Important)	2020-12-01
oval:org.opensuse.security:def:30627	P	Security update for Xen	2020-12-01
oval:org.opensuse.security:def:30993	P	Security update for jasper	2020-12-01
oval:org.opensuse.security:def:35480	P	Security update for php53 (Moderate)	2020-12-01
oval:org.opensuse.security:def:27043	P	tar on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:31398	P	Security update for perl (Moderate)	2020-12-01
oval:org.opensuse.security:def:33841	P	Security update for gtk2	2020-12-01
oval:org.opensuse.security:def:27469	P	libotr-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29820	P	Security update for java-1_6_0-ibm (Important)	2020-12-01
oval:org.opensuse.security:def:34303	P	Security update for quagga (Moderate)	2020-12-01
oval:org.opensuse.security:def:28253	P	Security update for libxml2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:34926	P	Security update for expat (Moderate)	2020-12-01
oval:org.opensuse.security:def:30564	P	Security update for poppler	2020-12-01
oval:org.opensuse.security:def:30770	P	Security update for augeas	2020-12-01
oval:org.opensuse.security:def:35392	P	Security update for opensc (Moderate)	2020-12-01
oval:org.opensuse.security:def:26851	P	Mesa-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33829	P	Security update for GnuTLS	2020-12-01
oval:org.opensuse.security:def:27265	P	perl-Tk on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:31502	P	Security update for python27 (Moderate)	2020-12-01
oval:org.opensuse.security:def:34157	P	Security update for openssh-openssl1 (Moderate)	2020-12-01
oval:org.opensuse.security:def:27571	P	taglib-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:34706	P	Security update for ImageMagick (Important)	2020-12-01
oval:org.opensuse.security:def:30476	P	Security update for bind (Important)	2020-12-01
oval:org.opensuse.security:def:35355	P	security update for mysql (Moderate)	2020-12-01
oval:org.opensuse.security:def:30685	P	Security update for LibVNCServer (Important)	2020-12-01
oval:org.opensuse.security:def:35173	P	Security update for krb5 (Moderate)	2020-12-01
oval:org.opensuse.security:def:26839	P	wget on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:31050	P	Security update for the Linux Kernel	2020-12-01
oval:org.opensuse.security:def:35507	P	Security update for postgresql10 (Important)	2020-12-01
oval:org.opensuse.security:def:27124	P	findutils on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:31437	P	Security update for php53 (Moderate)	2020-12-01
oval:org.opensuse.security:def:27518	P	mozilla-xulrunner192-devel on GA media (Moderate)	2020-12-01
oval:com.ubuntu.bionic:def:201828180000000	V	CVE-2018-2818 on Ubuntu 18.04 LTS (bionic) - medium.	2018-04-19
oval:com.ubuntu.xenial:def:201828180000000	V	CVE-2018-2818 on Ubuntu 16.04 LTS (xenial) - medium.	2018-04-19
oval:com.ubuntu.disco:def:201828180000000	V	CVE-2018-2818 on Ubuntu 19.04 (disco) - medium.	2018-04-19
oval:com.ubuntu.artful:def:20182818000	V	CVE-2018-2818 on Ubuntu 17.10 (artful) - medium.	2018-04-18
oval:com.ubuntu.xenial:def:20182818000	V	CVE-2018-2818 on Ubuntu 16.04 LTS (xenial) - medium.	2018-04-18
oval:com.ubuntu.bionic:def:20182818000	V	CVE-2018-2818 on Ubuntu 18.04 LTS (bionic) - medium.	2018-04-18
oval:com.ubuntu.cosmic:def:20182818000	V	CVE-2018-2818 on Ubuntu 18.10 (cosmic) - medium.	2018-04-18
oval:com.ubuntu.cosmic:def:201828180000000	V	CVE-2018-2818 on Ubuntu 18.10 (cosmic) - medium.	2018-04-18
oval:com.ubuntu.trusty:def:20182818000	V	CVE-2018-2818 on Ubuntu 14.04 LTS (trusty) - medium.	2018-04-18

BACK