CVE-2017-10155 in MySQL Server
Summary
by MITRE
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Auth). Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 01/18/2021
The vulnerability identified as CVE-2017-10155 represents a critical availability flaw within Oracle MySQL Server's pluggable authentication subsystem. This weakness exists in specifically versioned releases including 5.6.37 and earlier, as well as 5.7.19 and earlier, making it a widespread concern across multiple MySQL server versions. The vulnerability resides within the Server: Pluggable Auth subcomponent, which handles authentication mechanisms and user access controls within the database system. The flaw's classification as easily exploitable indicates that attackers can leverage this weakness without requiring authentication credentials or specialized privileges, making it particularly dangerous in networked environments where MySQL servers are accessible to external parties.
The technical nature of this vulnerability manifests through a denial of service condition that can be triggered by unauthenticated attackers who gain network access via multiple protocols. This means that malicious actors can exploit the flaw regardless of whether they are connecting through TCP/IP, Unix sockets, or other supported network interfaces. The vulnerability specifically enables attackers to cause either a hang condition or a frequently repeatable crash of the MySQL Server process, effectively rendering the database service unavailable to legitimate users and applications. The CVSS 3.0 scoring system assigns this vulnerability a base score of 7.5, which reflects the high impact on system availability, with the vector indicating network accessibility, low attack complexity, no privileges required, and no user interaction needed for exploitation.
The operational impact of CVE-2017-10155 extends beyond simple service interruption, as it can lead to complete system unavailability that affects business operations, data accessibility, and application functionality. Organizations running affected MySQL versions face significant risk of service disruption, particularly in environments where database availability is critical for application performance. The vulnerability's exploitation can result in cascading failures where dependent applications and services become unusable due to database unavailability. This type of denial of service attack can be particularly damaging in production environments where database servers handle critical transactional data processing, as the impact can extend to financial systems, customer management platforms, and other business-critical applications that depend on MySQL database services.
Organizations should implement immediate mitigations including applying the relevant Oracle security patches and updates that address this vulnerability, as well as implementing network segmentation and access controls to limit exposure. The vulnerability aligns with CWE-119, which addresses improper restriction of operations within a limited context, and can be mapped to ATT&CK technique T1499.004 for network denial of service attacks. Additional protective measures include implementing firewall rules to restrict access to MySQL ports, configuring network access controls to limit who can connect to database services, and monitoring for unusual connection patterns or service disruptions that might indicate exploitation attempts. Regular vulnerability assessments and penetration testing should be conducted to identify and remediate similar weaknesses in the database infrastructure. The remediation process should include comprehensive testing of patched systems to ensure that the vulnerability has been properly addressed without introducing compatibility issues or unintended side effects in database operations.