CVE-2016-6662 Privilege escalation in n/a

Critical 9.8 Published 20 Sep 2016 Updated 6 Aug 2024

Local attackers can escalate privileges to root and execute arbitrary code by manipulating MySQL configuration files via the general_log_file setting.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-6662?

CVE-2016-6662 is a critical vulnerability in Debian Debian Linux, published on 20 Sep 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.

Weakness: CWE-264

Which versions are affected by CVE-2016-6662?

It affects 12 products.

Linux distribution packages (31)

`mariadb-galera` Red Hat:openstack:5::el6	All versions	`0:5.5.42-1.1.el6ost`
`mariadb-galera-common` Red Hat:openstack:5::el6	All versions	`0:5.5.42-1.1.el6ost`
`mariadb-galera-debuginfo` Red Hat:openstack:5::el6	All versions	`0:5.5.42-1.1.el6ost`
`mariadb-galera-server` Red Hat:openstack:5::el6	All versions	`0:5.5.42-1.1.el6ost`
`mariadb-galera` Red Hat:openstack:5::el7	All versions	`1:5.5.42-1.2.el7ost`
`mariadb-galera-common` Red Hat:openstack:5::el7	All versions	`1:5.5.42-1.2.el7ost`
`mariadb-galera-debuginfo` Red Hat:openstack:5::el7	All versions	`1:5.5.42-1.2.el7ost`
`mariadb-galera-server` Red Hat:openstack:5::el7	All versions	`1:5.5.42-1.2.el7ost`
`mariadb-galera` Red Hat:openstack:6::el7	All versions	`1:5.5.42-1.2.el7ost`
`mariadb-galera-common` Red Hat:openstack:6::el7	All versions	`1:5.5.42-1.2.el7ost`
`mariadb-galera-debuginfo` Red Hat:openstack:6::el7	All versions	`1:5.5.42-1.2.el7ost`
`mariadb-galera-server` Red Hat:openstack:6::el7	All versions	`1:5.5.42-1.2.el7ost`
`mariadb-galera` Red Hat:openstack:7::el7	All versions	`1:5.5.42-5.el7ost`
`mariadb-galera-common` Red Hat:openstack:7::el7	All versions	`1:5.5.42-5.el7ost`
`mariadb-galera-debuginfo` Red Hat:openstack:7::el7	All versions	`1:5.5.42-5.el7ost`
`mariadb-galera-server` Red Hat:openstack:7::el7	All versions	`1:5.5.42-5.el7ost`
`mariadb-galera` Red Hat:openstack:8::el7	All versions	`1:5.5.42-5.el7ost`
`mariadb-galera-common` Red Hat:openstack:8::el7	All versions	`1:5.5.42-5.el7ost`
`mariadb-galera-debuginfo` Red Hat:openstack:8::el7	All versions	`1:5.5.42-5.el7ost`
`mariadb-galera-server` Red Hat:openstack:8::el7	All versions	`1:5.5.42-5.el7ost`
`mariadb-galera` Red Hat:openstack:9::el7	All versions	`1:5.5.42-5.el7ost`
`mariadb-galera-common` Red Hat:openstack:9::el7	All versions	`1:5.5.42-5.el7ost`
`mariadb-galera-debuginfo` Red Hat:openstack:9::el7	All versions	`1:5.5.42-5.el7ost`
`mariadb-galera-server` Red Hat:openstack:9::el7	All versions	`1:5.5.42-5.el7ost`
`mariadb` SUSE:Linux Enterprise Desktop 12 SP1	All versions	`10.0.27-12.1`
`mariadb` SUSE:Linux Enterprise Server 12 SP1	All versions	`10.0.27-12.1`
`mariadb` SUSE:Linux Enterprise Server 12-LTSS	All versions	`10.0.27-20.13.1`
`mariadb` SUSE:Linux Enterprise Server for SAP Applications 12	All versions	`10.0.27-20.13.1`
`mariadb` SUSE:Linux Enterprise Server for SAP Applications 12 SP1	All versions	`10.0.27-12.1`
`mariadb` SUSE:Linux Enterprise Software Development Kit 12 SP1	All versions	`10.0.27-12.1`
`mariadb` SUSE:Linux Enterprise Workstation Extension 12 SP1	All versions	`10.0.27-12.1`

Products include Debian Debian Linux, Mariadb Mariadb, Oracle Mysql, Percona Percona Server, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop and 6 more.

How do I fix CVE-2016-6662?

Apply the vendor's patch.

Is CVE-2016-6662 being exploited?

There is no known exploitation of CVE-2016-6662 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry and 6 proofs of concept on GitHub.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2016-6662, DLA-624-1, DSA-3666-1, GHSA-76m2-pqh7-www3, RHSA-2016:2058, RHSA-2016:2059 and 8 more.