CVE-2016-6662: Remote Root Code Execution / Privilege Escalation

[Moritz]

According to
http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html
Percona MySQL Server is vulnerable to a remote root exploit discussed there (inclusing PoC).

The advisory states that the following versions are affected:
> MySQL <= 5.7.15
> 5.6.33
> 5.5.52

It further states:
> The vulnerability was reported to Oracle on 29th of July 2016 and triaged by the security team.
> It was also reported to the other affected vendors including PerconaDB and MariaDB.
>
> The vulnerabilities were patched by PerconaDB and MariaDB vendors by the end of 30th of August.
> During the course of the patching by these vendors the patches went into public repositories and the fixed security issues were also mentioned in the new releases which could be noticed by malicious attackers.

Looking at Percona Server 5.7 release notes at
https://www.percona.com/doc/percona-server/5.7/release-notes/release-notes_index.html
the latest available release (at the time of writing) is Percona Server 5.7.14-7, released on August 23rd, 2016. The release notes for this particular version do not reference CVE-2016-6662.

Is it correct that there is currently no patched release available for Percona (MySQL) Server?

Which mitigation strategies (other than what is discussed in the researchers' advisory) do you recommend?

While this is a bug report which refers to a security vulnerability, please do keep it open to the public since this is already public information. (I will post it privately so as to notify your security team, then make it public if Launchpad allows me to do so.)

Thank you.

[Thomas Deutschmann (whissi)]

On Gentoo we migrated the old bug report into a tracker bug; Updating remote watch to reflect the new bug report for dev-db/percona-server on Gentoo.

[Roel Van de Paar (roel11)]

https://www.percona.com/blog/2016/09/12/database-affected-cve-2016-6662/

[Laurynas Biveinis (laurynas-biveinis)]

Percona Server version 5.7.14-7 contains a fix, although the release notes do not reference the CVE number. More information at the blog post link posted above, closing the bug now - please reopen should you have any concerns.

[Shahriyar Rzayev (rzayev-sehriyar)]

Percona now uses JIRA for bug reports so this bug report is migrated to: https://jira.percona.com/browse/PS-3554