RHSA-2016:2058
Vulnerability from csaf_redhat - Published: 2016-10-13 19:35 - Updated: 2025-11-21 17:57Summary
Red Hat Security Advisory: mariadb-galera security update
Severity
Important
Notes
Topic: An update for mariadb-galera is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Galera is a synchronous multi-master cluster for MariaDB.
Security Fix(es):
* It was discovered that the MySQL logging functionality allowed writing to MySQL configuration files. An administrative database user, or a database user with FILE privileges, could possibly use this flaw to run arbitrary commands with root privileges on the system running the database server. (CVE-2016-6662)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
It was discovered that the MySQL logging functionality allowed writing to MySQL configuration files. An administrative database user, or a database user with FILE privileges, could possibly use this flaw to run arbitrary commands with root privileges on the system running the database server.
9.8 (Critical)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
https://access.redhat.com/errata/RHSA-2016:2058
Workaround
- Ensure all MySQL / MariaDB configuration files are not writeable to the mysql user. This is the default configuration in Red Hat products.
- Ensure that non-administrative database users are not granted FILE privilege. Applications accessing data in MySQL / MariaDB databases, including web application potentially vulnerable to SQL injections, should use database accounts with the lowest privileges required.
- If FILE permission needs to be granted to some non-administrative database users, use secure_file_priv setting to limit where files can be written to or read from.
References
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for mariadb-galera is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Galera is a synchronous multi-master cluster for MariaDB.\n\nSecurity Fix(es):\n\n* It was discovered that the MySQL logging functionality allowed writing to MySQL configuration files. An administrative database user, or a database user with FILE privileges, could possibly use this flaw to run arbitrary commands with root privileges on the system running the database server. (CVE-2016-6662)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:2058",
"url": "https://access.redhat.com/errata/RHSA-2016:2058"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2016-6662",
"url": "https://access.redhat.com/security/cve/CVE-2016-6662"
},
{
"category": "external",
"summary": "1375198",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375198"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2058.json"
}
],
"title": "Red Hat Security Advisory: mariadb-galera security update",
"tracking": {
"current_release_date": "2025-11-21T17:57:49+00:00",
"generator": {
"date": "2025-11-21T17:57:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2016:2058",
"initial_release_date": "2016-10-13T19:35:31+00:00",
"revision_history": [
{
"date": "2016-10-13T19:35:31+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-10-13T19:35:31+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:57:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:5::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "mariadb-galera-0:5.5.42-1.1.el6ost.src",
"product": {
"name": "mariadb-galera-0:5.5.42-1.1.el6ost.src",
"product_id": "mariadb-galera-0:5.5.42-1.1.el6ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mariadb-galera@5.5.42-1.1.el6ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "mariadb-galera-debuginfo-0:5.5.42-1.1.el6ost.x86_64",
"product": {
"name": "mariadb-galera-debuginfo-0:5.5.42-1.1.el6ost.x86_64",
"product_id": "mariadb-galera-debuginfo-0:5.5.42-1.1.el6ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mariadb-galera-debuginfo@5.5.42-1.1.el6ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mariadb-galera-common-0:5.5.42-1.1.el6ost.x86_64",
"product": {
"name": "mariadb-galera-common-0:5.5.42-1.1.el6ost.x86_64",
"product_id": "mariadb-galera-common-0:5.5.42-1.1.el6ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mariadb-galera-common@5.5.42-1.1.el6ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mariadb-galera-server-0:5.5.42-1.1.el6ost.x86_64",
"product": {
"name": "mariadb-galera-server-0:5.5.42-1.1.el6ost.x86_64",
"product_id": "mariadb-galera-server-0:5.5.42-1.1.el6ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mariadb-galera-server@5.5.42-1.1.el6ost?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "mariadb-galera-0:5.5.42-1.1.el6ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:mariadb-galera-0:5.5.42-1.1.el6ost.src"
},
"product_reference": "mariadb-galera-0:5.5.42-1.1.el6ost.src",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mariadb-galera-common-0:5.5.42-1.1.el6ost.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:mariadb-galera-common-0:5.5.42-1.1.el6ost.x86_64"
},
"product_reference": "mariadb-galera-common-0:5.5.42-1.1.el6ost.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mariadb-galera-debuginfo-0:5.5.42-1.1.el6ost.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:mariadb-galera-debuginfo-0:5.5.42-1.1.el6ost.x86_64"
},
"product_reference": "mariadb-galera-debuginfo-0:5.5.42-1.1.el6ost.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mariadb-galera-server-0:5.5.42-1.1.el6ost.x86_64 as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:mariadb-galera-server-0:5.5.42-1.1.el6ost.x86_64"
},
"product_reference": "mariadb-galera-server-0:5.5.42-1.1.el6ost.x86_64",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-6662",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"discovery_date": "2016-09-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1375198"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the MySQL logging functionality allowed writing to MySQL configuration files. An administrative database user, or a database user with FILE privileges, could possibly use this flaw to run arbitrary commands with root privileges on the system running the database server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "All MySQL and MariaDB packages in Red Hat Enterprise Linux and Red Hat Software Collections install the my.cnf configuration file in /etc as root-owned and not writeable to mysqld\u0027s mysql user. This default configuration stops the published exploit for this issue.\n\nAll MySQL and MariaDB packages for Red Hat Enterprise Linux 7 (either those directly included in Red Hat Enterprise Linux 7 or from Red Hat Software Collections for Red Hat Enterprise Linux 7) run mysqld_safe with mysql user privileges and not root privileges, limiting the potential impact to code execution as mysql system user.\n\nThe MySQL 5.1 packages in Red Hat Enterprise Linux 6 do not implement support for library preloading, completely preventing the remote attack vector used by the published exploit.\n\nFor additional details, refer to:\n\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1375198#c12",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:mariadb-galera-0:5.5.42-1.1.el6ost.src",
"6Server-RH6-RHOS-5.0:mariadb-galera-common-0:5.5.42-1.1.el6ost.x86_64",
"6Server-RH6-RHOS-5.0:mariadb-galera-debuginfo-0:5.5.42-1.1.el6ost.x86_64",
"6Server-RH6-RHOS-5.0:mariadb-galera-server-0:5.5.42-1.1.el6ost.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6662"
},
{
"category": "external",
"summary": "RHBZ#1375198",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375198"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6662",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6662"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6662",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6662"
},
{
"category": "external",
"summary": "https://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.txt",
"url": "https://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.txt"
}
],
"release_date": "2016-09-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-10-13T19:35:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.",
"product_ids": [
"6Server-RH6-RHOS-5.0:mariadb-galera-0:5.5.42-1.1.el6ost.src",
"6Server-RH6-RHOS-5.0:mariadb-galera-common-0:5.5.42-1.1.el6ost.x86_64",
"6Server-RH6-RHOS-5.0:mariadb-galera-debuginfo-0:5.5.42-1.1.el6ost.x86_64",
"6Server-RH6-RHOS-5.0:mariadb-galera-server-0:5.5.42-1.1.el6ost.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2058"
},
{
"category": "workaround",
"details": "- Ensure all MySQL / MariaDB configuration files are not writeable to the mysql user. This is the default configuration in Red Hat products.\n\n- Ensure that non-administrative database users are not granted FILE privilege. Applications accessing data in MySQL / MariaDB databases, including web application potentially vulnerable to SQL injections, should use database accounts with the lowest privileges required.\n\n- If FILE permission needs to be granted to some non-administrative database users, use secure_file_priv setting to limit where files can be written to or read from.",
"product_ids": [
"6Server-RH6-RHOS-5.0:mariadb-galera-0:5.5.42-1.1.el6ost.src",
"6Server-RH6-RHOS-5.0:mariadb-galera-common-0:5.5.42-1.1.el6ost.x86_64",
"6Server-RH6-RHOS-5.0:mariadb-galera-debuginfo-0:5.5.42-1.1.el6ost.x86_64",
"6Server-RH6-RHOS-5.0:mariadb-galera-server-0:5.5.42-1.1.el6ost.x86_64"
]
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.1,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-RH6-RHOS-5.0:mariadb-galera-0:5.5.42-1.1.el6ost.src",
"6Server-RH6-RHOS-5.0:mariadb-galera-common-0:5.5.42-1.1.el6ost.x86_64",
"6Server-RH6-RHOS-5.0:mariadb-galera-debuginfo-0:5.5.42-1.1.el6ost.x86_64",
"6Server-RH6-RHOS-5.0:mariadb-galera-server-0:5.5.42-1.1.el6ost.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016)"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…