Free and open-source vulnerability scanner
Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.
Install NowAvailable for macOS, Windows, and Linux
Debian LTS Advisory ([SECURITY] [DLA 1079-1] libdbd-mysql-perl security update)
Information
Severity
Severity
Family
Family
CVSSv2 Base
CVSSv2 Base
CVSSv2 Vector
CVSSv2 Vector
Solution Type
Solution Type
Created
Created
Modified
Modified
Summary
The Perl library for communicating with MySQL database, used in the 'mysql' commandline client is vulnerable to a man in the middle attack in SSL configurations and remote crash when connecting to hostile servers. CVE-2017-10788 The DBD::mysql module through 4.042 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server. The use-after-free defect was introduced by relying on incorrect Oracle mysql_stmt_close documentation and code examples. CVE-2017-10789 The DBD::mysql module through 4.042 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a 'your communication with the server will be encrypted' statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.
Affected Software
Affected Software
libdbd-mysql-perl on Debian Linux
Detection Method
Detection Method
This check tests the installed software version using the apt package manager.
Solution
Solution
For Debian 7 'Wheezy', these problems have been fixed in version 4.021-1+deb7u3. We recommend that you upgrade your libdbd-mysql-perl packages.