# MA-641.112016: MyCERT Advisory - Severe MySQL Vulnerabilities Exploit Server Access

**Date:** 15 Nov 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-641.112016  
**Advisory ID:** MA-641.112016

---

#### **1.0    Introduction**
MyCERT is aware of two critical MySQL vulnerabilities; CVE-2016-6663 and CVE-2016-6664. The vulnerabilities can allow a local system user that has access to a database to escalate their privileges and execute arbitrary code as the database system user. From there, an attacker could successfully access all of the databases on the affected database server.
**2.0    Impact**
Exploitation of these vulnerabilities could potentially allow a remote attacker to take control of the affected system.
**3.0    Affected Products**
- MySQL prior to version 5.5.51
- MariaDB prior to version 5.5.52
- Percona Server prior to version 5.5.51-38.2
- Percona XtraDB Cluster prior to version 5.5.41-37.0
**4.0    Recommendation**
- MyCERT highly recommend your operating system and applications to be updated to the latest version.
> MySQL:
> <https://www.mysql.com/downloads/>
> Percona:
> [https://www.percona.com/blog/2016/11/02/percona-responds-to-cve-2016-6663-and-cve-2016-6664](https://www.percona.com/blog/2016/11/02/percona-responds-to-cve-2016-6663-and-cve-2016-6664/)
> MariaDB:
> <https://mariadb.com/kb/en/mariadb/mariadb-5552-release-notes/>
- Be alert and apply software patches released by the software vendors so that attackers cannot take advantage of the vulnerabilities.
- Many operating systems offer automatic updates. If this option is available, you should enable it.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendors and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#ef8c968d8a9dd6d6d6af8c968d8a9d9c8a8c9a9d869b96c18296) or [[email protected]](/cdn-cgi/l/email-protection#5934203a3c2b2d1934203a3c2b2d77362b3e773420)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0    References**
- <http://opensourceforu.com/2016/11/severe-mysql-vulnerabilities-surface-exploit-server-access/>
- [https://mariadb.com/kb/en/mariadb/security/](https://mariadb.com/kb/en/mariadb/security/ )
- <https://legalhackers.com/advisories/MySQL-Maria-Percona-RootPrivEsc-CVE-2016-6664-5617-Exploit.html>
- <https://security-tracker.debian.org/tracker/CVE-2016-6664>