CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 10.0
CWE Name:  Permissions Privileges and Access Controls
Summary: oracle mysql through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; mariadb before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and percona server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. note: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. note: the affected mysql version information is from oracle's october 2016 cpu. oracle has not commented on third-party claims that the issue was silently patched in mysql 5.5.52, 5.6.33, and 5.7.15.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2016-09-20
Last Modified Date: 2019-06-03