CVE-2016-6664 in MySQL
Summary
by MITRE • 01/25/2023
mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17, when using file-based logging, allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/25/2024
The vulnerability described in CVE-2016-6664 represents a critical privilege escalation flaw affecting multiple database systems including Oracle MySQL, MariaDB, and various Percona Server variants. This issue stems from improper handling of file operations within the mysqld_safe utility, which is responsible for starting and managing MySQL server processes. The vulnerability specifically manifests when the database system employs file-based logging mechanisms, creating a dangerous condition where local users with access to the mysql account can exploit symbolic link attacks to escalate their privileges to root level access.
The technical flaw resides in the way mysqld_safe processes error log files and other related files when they are accessed through symbolic links. When a user with mysql account access creates a malicious symbolic link pointing to a system file such as /etc/passwd or /etc/shadow, the mysqld_safe utility, upon processing these files during normal operation, will follow the symbolic link and write data to the target file instead of the intended log file. This behavior violates the principle of least privilege and creates an attack vector that bypasses normal access controls. The vulnerability is particularly concerning because it allows a low-privilege user to manipulate critical system files, potentially leading to complete system compromise.
The operational impact of this vulnerability is severe and extends beyond simple privilege escalation. Attackers can leverage this flaw to modify system authentication files, install backdoors, or manipulate database configurations to maintain persistent access. The attack requires only local access to the mysql account, which is typically available to database administrators and applications connecting to the database, making the attack surface relatively broad. Organizations running affected versions of MySQL, MariaDB, or Percona Server are at significant risk, especially in environments where database accounts have elevated privileges or where multiple applications share database access credentials. The vulnerability affects versions ranging from MySQL 5.5.51 through 5.7.14, along with corresponding MariaDB and Percona Server releases, indicating a widespread exposure across multiple database implementations.
Security professionals should prioritize immediate patching of affected systems, as the vulnerability provides a straightforward path to root access without requiring network connectivity or complex exploitation techniques. Organizations should implement strict file permission controls and audit access to database directories, particularly focusing on error log locations and other files that may be subject to symbolic link manipulation. The vulnerability aligns with CWE-59, which addresses improper handling of symbolic links, and represents a classic example of privilege escalation through file system manipulation. Mitigation strategies should include comprehensive monitoring of log file modifications, implementation of file integrity checking mechanisms, and adherence to the principle of least privilege for database account access. Additionally, this vulnerability demonstrates the importance of validating file operations in system utilities and highlights the need for robust input validation in database management software to prevent similar issues in future deployments.