Detections
Analytics
MySQL Enterprise Monitor 3.1.x < 3.1.7.8023 / 3.2.x < 3.2.7.1204 / 3.3.x < 3.3.3.1199 Multiple Vulnerabilities (April 2017 CPU)
critical Nessus Plugin ID 99593
Language:
Synopsis
A web application running on the remote host is affected by multiple vulnerabilities.Description
According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.1.x prior to 3.1.7.8023, 3.2.x prior to 3.2.7.1204, or 3.3.x prior to 3.3.3.1199. It is, therefore, affected by multiple vulnerabilities :- A denial of service vulnerability exists in the Apache Commons component in the FileUpload functionality due to improper handling of file upload requests. An unauthenticated, remote attacker can exploit this, via a specially crafted content-type header, to cause a denial of service condition. Note that this vulnerability does not affect MySQL Enterprise Monitor versions 3.3.x.
(CVE-2016-3092)
- An unspecified flaw exists in the Apache Struts component that is triggered during the cleanup of action names. An unauthenticated, remote attacker can exploit this, via a specially crafted payload, to perform unspecified actions. (CVE-2016-4436)
- A carry propagation error exists in the OpenSSL component in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055)
- An unspecified flaw exists in the Monitoring Server subcomponent that allows an authenticated, remote attacker to impact confidentiality and integrity.
(CVE-2017-3306)
- An unspecified flaw exists in the Monitoring Server subcomponent that allows an authenticated, remote attacker to impact integrity and availability.
(CVE-2017-3307)
- An out-of-bounds read error exists in the OpenSSL component when handling packets using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An unauthenticated, remote attacker can exploit this, via specially crafted truncated packets, to cause a denial of service condition. (CVE-2017-3731)
- A carry propagating error exists in the OpenSSL component in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An unauthenticated, remote attacker with sufficient resources can exploit this to obtain sensitive information regarding private keys.
(CVE-2017-3732)
- A remote code execution vulnerability exists in the Apache Struts component in the Jakarta Multipart parser due to improper handling of the Content-Type, Content-Disposition, and Content-Length headers.
An unauthenticated, remote attacker can exploit this, via a specially crafted header value in the HTTP request, to execute arbitrary code. (CVE-2017-5638)
Solution
Upgrade to MySQL Enterprise Monitor version 3.1.7.8023 / 3.2.7.1204 / 3.3.3.1199 or later as referenced in the April 2017 Oracle Critical Patch Update advisory.Note that the 3.2.x version was fixed for the CVE-2016-4436 vulnerability in version 3.2.6.1182.
See Also
http://www.nessus.org/u?d679be85
http://www.nessus.org/u?50229a1a
http://www.nessus.org/u?eb4db3c7
https://support.oracle.com/rs?type=doc&id=2244179.1
https://support.oracle.com/rs?type=doc&id=2279658.1
http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html
Plugin Details
Severity: Critical
ID: 99593
File Name: mysql_enterprise_monitor_3_3_3_1199.nasl
Version: 1.17
Type: remote
Family: CGI abuses
Published: 4/21/2017
Updated: 11/30/2021
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 10.0
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2017-5638
CVSS v3
Risk Factor: Critical
Base Score: 10
Temporal Score: 9.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:X
Vulnerability Information
CPE: cpe:/a:oracle:mysql_enterprise_monitor
Required KB Items: installed_sw/MySQL Enterprise Monitor, Settings/ParanoidReport
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/18/2017
Vulnerability Publication Date: 6/21/2016
CISA Known Exploited Vulnerability Due Dates: 5/3/2022
Exploitable With
CANVAS (CANVAS)
Core Impact
Metasploit (Apache Struts Jakarta Multipart Parser OGNL Injection)
Reference Information
CVE: CVE-2016-3092, CVE-2016-4436, CVE-2016-7055, CVE-2017-3306, CVE-2017-3307, CVE-2017-3731, CVE-2017-3732, CVE-2017-5638
BID: 91280, 91453, 94242, 95813, 95814, 96729, 97724, 97844
CERT: 834067