Signature Detail

DB: MYSQL Privilege Escalation

This signature detects attempts to exploit a known vulnerability against MySQL. A successful exploitation could allow attackers to execute arbitrary code with root privileges which would then allow them to fully compromise the server on which an affected version of MySQL is running.

Extended Description

Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17 allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.

Affected Products

• Mariadb mariadb 10.0.0
• Mariadb mariadb 10.0.1
• Mariadb mariadb 10.0.10
• Mariadb mariadb 10.0.11
• Mariadb mariadb 10.0.12
• Mariadb mariadb 10.0.13
• Mariadb mariadb 10.0.14
• Mariadb mariadb 10.0.15
• Mariadb mariadb 10.0.16
• Mariadb mariadb 10.0.17
• Mariadb mariadb 10.0.18
• Mariadb mariadb 10.0.19
• Mariadb mariadb 10.0.2
• Mariadb mariadb 10.0.20
• Mariadb mariadb 10.0.21
• Mariadb mariadb 10.0.22
• Mariadb mariadb 10.0.23
• Mariadb mariadb 10.0.24
• Mariadb mariadb 10.0.25
• Mariadb mariadb 10.0.26
• Mariadb mariadb 10.0.27
• Mariadb mariadb 10.0.3
• Mariadb mariadb 10.0.4
• Mariadb mariadb 10.0.5
• Mariadb mariadb 10.0.6
• Mariadb mariadb 10.0.7
• Mariadb mariadb 10.0.8
• Mariadb mariadb 10.0.9
• Mariadb mariadb 10.1.0
• Mariadb mariadb 10.1.1
• Mariadb mariadb 10.1.10
• Mariadb mariadb 10.1.11
• Mariadb mariadb 10.1.12
• Mariadb mariadb 10.1.13
• Mariadb mariadb 10.1.14
• Mariadb mariadb 10.1.15
• Mariadb mariadb 10.1.16
• Mariadb mariadb 10.1.17
• Mariadb mariadb 10.1.2
• Mariadb mariadb 10.1.3
• Mariadb mariadb 10.1.4
• Mariadb mariadb 10.1.5
• Mariadb mariadb 10.1.6
• Mariadb mariadb 10.1.7
• Mariadb mariadb 10.1.8
• Mariadb mariadb 10.1.9
• Mariadb mariadb 5.5.20
• Mariadb mariadb 5.5.21
• Mariadb mariadb 5.5.22
• Mariadb mariadb 5.5.23
• Mariadb mariadb 5.5.24
• Mariadb mariadb 5.5.25
• Mariadb mariadb 5.5.27
• Mariadb mariadb 5.5.28
• Mariadb mariadb 5.5.28a
• Mariadb mariadb 5.5.33
• Mariadb mariadb 5.5.34
• Mariadb mariadb 5.5.35
• Mariadb mariadb 5.5.40
• Mariadb mariadb 5.5.43
• Mariadb mariadb 5.5.46
• Mariadb mariadb 5.5.47
• Mariadb mariadb 5.5.48
• Mariadb mariadb 5.5.49
• Mariadb mariadb 5.5.50
• Mariadb mariadb 5.5.51
• Oracle mysql 5.5.0
• Oracle mysql 5.5.1
• Oracle mysql 5.5.10
• Oracle mysql 5.5.11
• Oracle mysql 5.5.12
• Oracle mysql 5.5.13
• Oracle mysql 5.5.14
• Oracle mysql 5.5.15
• Oracle mysql 5.5.16
• Oracle mysql 5.5.17
• Oracle mysql 5.5.18
• Oracle mysql 5.5.19
• Oracle mysql 5.5.2
• Oracle mysql 5.5.20
• Oracle mysql 5.5.21
• Oracle mysql 5.5.22
• Oracle mysql 5.5.23
• Oracle mysql 5.5.24
• Oracle mysql 5.5.25
• Oracle mysql 5.5.26
• Oracle mysql 5.5.27
• Oracle mysql 5.5.28
• Oracle mysql 5.5.29
• Oracle mysql 5.5.3
• Oracle mysql 5.5.30
• Oracle mysql 5.5.31
• Oracle mysql 5.5.32
• Oracle mysql 5.5.33
• Oracle mysql 5.5.34
• Oracle mysql 5.5.35
• Oracle mysql 5.5.36
• Oracle mysql 5.5.37
• Oracle mysql 5.5.38
• Oracle mysql 5.5.39
• Oracle mysql 5.5.4
• Oracle mysql 5.5.40
• Oracle mysql 5.5.41
• Oracle mysql 5.5.42
• Oracle mysql 5.5.43
• Oracle mysql 5.5.44
• Oracle mysql 5.5.45
• Oracle mysql 5.5.46
• Oracle mysql 5.5.47
• Oracle mysql 5.5.48
• Oracle mysql 5.5.49
• Oracle mysql 5.5.5
• Oracle mysql 5.5.50
• Oracle mysql 5.5.51
• Oracle mysql 5.5.52
• Oracle mysql 5.5.6
• Oracle mysql 5.5.7
• Oracle mysql 5.5.8
• Oracle mysql 5.5.9
• Oracle mysql 5.6.0
• Oracle mysql 5.6.1
• Oracle mysql 5.6.10
• Oracle mysql 5.6.11
• Oracle mysql 5.6.12
• Oracle mysql 5.6.13
• Oracle mysql 5.6.14
• Oracle mysql 5.6.15
• Oracle mysql 5.6.16
• Oracle mysql 5.6.17
• Oracle mysql 5.6.18
• Oracle mysql 5.6.19
• Oracle mysql 5.6.2
• Oracle mysql 5.6.20
• Oracle mysql 5.6.21
• Oracle mysql 5.6.22
• Oracle mysql 5.6.23
• Oracle mysql 5.6.24
• Oracle mysql 5.6.25
• Oracle mysql 5.6.26
• Oracle mysql 5.6.27
• Oracle mysql 5.6.28
• Oracle mysql 5.6.29
• Oracle mysql 5.6.3
• Oracle mysql 5.6.30
• Oracle mysql 5.6.31
• Oracle mysql 5.6.32
• Oracle mysql 5.6.33
• Oracle mysql 5.6.4
• Oracle mysql 5.6.5
• Oracle mysql 5.6.6
• Oracle mysql 5.6.7
• Oracle mysql 5.6.8
• Oracle mysql 5.6.9
• Oracle mysql 5.7.0
• Oracle mysql 5.7.1
• Oracle mysql 5.7.10
• Oracle mysql 5.7.11
• Oracle mysql 5.7.12
• Oracle mysql 5.7.13
• Oracle mysql 5.7.14
• Oracle mysql 5.7.15
• Oracle mysql 5.7.2
• Oracle mysql 5.7.3
• Oracle mysql 5.7.4
• Oracle mysql 5.7.5
• Oracle mysql 5.7.6
• Oracle mysql 5.7.7
• Oracle mysql 5.7.8
• Oracle mysql 5.7.9
• Oracle mysql 8.0
• Percona percona_server 5.5
• Percona percona_server 5.5.10-20.1
• Percona percona_server 5.5.11-20.2
• Percona percona_server 5.5.12-20.3
• Percona percona_server 5.5.13-20.4
• Percona percona_server 5.5.14-20.5
• Percona percona_server 5.5.15-21.0
• Percona percona_server 5.5.16-22.0
• Percona percona_server 5.5.18-23.0
• Percona percona_server 5.5.19-24.0
• Percona percona_server 5.5.20-24.1
• Percona percona_server 5.5.21-25.0
• Percona percona_server 5.5.21-25.1
• Percona percona_server 5.5.22-25.2
• Percona percona_server 5.5.23-25.3
• Percona percona_server 5.5.24-26.0
• Percona percona_server 5.5.25a-27.1
• Percona percona_server 5.5.27-28.0
• Percona percona_server 5.5.27-28.1
• Percona percona_server 5.5.27-29.0
• Percona percona_server 5.5.28-29.1
• Percona percona_server 5.5.28-29.2
• Percona percona_server 5.5.28-29.3
• Percona percona_server 5.5.28-29.4
• Percona percona_server 5.5.29-30.0
• Percona percona_server 5.5.30-30.1
• Percona percona_server 5.5.30-30.2
• Percona percona_server 5.5.31-30.3
• Percona percona_server 5.5.32-31.0
• Percona percona_server 5.5.33-31.1
• Percona percona_server 5.5.34-32.0
• Percona percona_server 5.5.35-33.0
• Percona percona_server 5.5.36-34.0
• Percona percona_server 5.5.36-34.1
• Percona percona_server 5.5.36-34.2
• Percona percona_server 5.5.37-35.0
• Percona percona_server 5.5.37-35.1
• Percona percona_server 5.5.38-35.2
• Percona percona_server 5.5.39-36.0
• Percona percona_server 5.5.40-36.1
• Percona percona_server 5.5.41-37.0
• Percona percona_server 5.5.42-37.1
• Percona percona_server 5.5.43-37.2
• Percona percona_server 5.5.44-37.3
• Percona percona_server 5.5.45-37.4
• Percona percona_server 5.5.46-37.5
• Percona percona_server 5.5.46-37.6
• Percona percona_server 5.5.47-37.7
• Percona percona_server 5.5.48-37.8
• Percona percona_server 5.5.49-37.9
• Percona percona_server 5.5.50-38.0
• Percona percona_server 5.5.51-38.1
• Percona percona_server 5.5.7
• Percona percona_server 5.5.8-20
• Percona percona_server 5.5.9-20.1
• Percona percona_server 5.6
• Percona percona_server 5.6.10-60.2
• Percona percona_server 5.6.11-60.3
• Percona percona_server 5.6.12-60.4
• Percona percona_server 5.6.13-60.5
• Percona percona_server 5.6.13-60.6
• Percona percona_server 5.6.13-61.0
• Percona percona_server 5.6.14-62.0
• Percona percona_server 5.6.15-63.0
• Percona percona_server 5.6.16-64.0
• Percona percona_server 5.6.16-64.1
• Percona percona_server 5.6.16-64.2
• Percona percona_server 5.6.17-65.0
• Percona percona_server 5.6.17-66.0
• Percona percona_server 5.6.19-67.0
• Percona percona_server 5.6.20-68.0
• Percona percona_server 5.6.21-69.0
• Percona percona_server 5.6.21-70.0
• Percona percona_server 5.6.21-70.1
• Percona percona_server 5.6.22-71.0
• Percona percona_server 5.6.22-72.0
• Percona percona_server 5.6.23-72.1
• Percona percona_server 5.6.24-72.2
• Percona percona_server 5.6.25-73.0
• Percona percona_server 5.6.25-73.1
• Percona percona_server 5.6.26-74.0
• Percona percona_server 5.6.27-75.0
• Percona percona_server 5.6.27-76.0
• Percona percona_server 5.6.28-76.1
• Percona percona_server 5.6.29-76.2
• Percona percona_server 5.6.30-76.3
• Percona percona_server 5.6.31-77.0
• Percona percona_server 5.6.32-78.0
• Percona percona_server 5.6.5-60.0
• Percona percona_server 5.6.6-60.1
• Percona percona_server 5.7
• Percona percona_server 5.7.10-1
• Percona percona_server 5.7.10-2
• Percona percona_server 5.7.10-3
• Percona percona_server 5.7.11-4
• Percona percona_server 5.7.12-5
• Percona percona_server 5.7.13-6
• Percona percona_server 5.7.14-7
• Percona xtradb_cluster 5.5
• Percona xtradb_cluster 5.5.27-23.6
• Percona xtradb_cluster 5.5.29-23.7.1
• Percona xtradb_cluster 5.5.29-23.7.2
• Percona xtradb_cluster 5.5.30-23.7.4
• Percona xtradb_cluster 5.5.31-23.7.5
• Percona xtradb_cluster 5.5.34-25.9
• Percona xtradb_cluster 5.5.37-25.10
• Percona xtradb_cluster 5.5.39-25.11
• Percona xtradb_cluster 5.6
• Percona xtradb_cluster 5.6.14-25.1
• Percona xtradb_cluster 5.6.15-25.2
• Percona xtradb_cluster 5.6.15-25.3
• Percona xtradb_cluster 5.6.15-25.4
• Percona xtradb_cluster 5.6.15-25.5
• Percona xtradb_cluster 5.6.19-25.6
• Percona xtradb_cluster 5.6.20-25.7
• Percona xtradb_cluster 5.6.21-25.8
• Percona xtradb_cluster 5.6.22-25.8
• Percona xtradb_cluster 5.6.24-25.11
• Percona xtradb_cluster 5.6.25-25.12
• Percona xtradb_cluster 5.6.26-25.12
• Percona xtradb_cluster 5.6.27-25.13
• Percona xtradb_cluster 5.6.28-25.14
• Percona xtradb_cluster 5.6.29-25.15
• Percona xtradb_cluster 5.6.30-25.16
• Percona xtradb_cluster 5.6.30-25.16.2
• Percona xtradb_cluster 5.6.30-25.16.3
• Percona xtradb_cluster 5.7
• Percona xtradb_cluster 5.7.11-25.14.2
• Percona xtradb_cluster 5.7.11-4
• Percona xtradb_cluster 5.7.12-26.16

References

• CVE: CVE-2016-6662
• CVE: CVE-2016-6663
• URL: http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html