{ "id": "CVE-2016-2047", "sourceIdentifier": "cve@mitre.org", "published": "2016-01-27T20:59:05.610", "lastModified": "2019-12-27T16:08:55.810", "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", "value": "The ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10; Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier; and Percona Server do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a \"/CN=\" string in a field in a certificate, as demonstrated by \"/OU=/CN=bar.com/CN=foo.com.\"" }, { "lang": "es", "value": "La funci\u00f3n ssl_verify_server_cert en sql-common/client.c en MariaDB en versiones anteriores a 5.5.47, 10.0.x en versiones anteriores a 10.0.23 y 10.1.x en versiones anteriores a 10.1.10; Oracle MySQL 5.5.48 y versiones anteriores, 5.6.29 y versiones anteriores y 5.7.11 y versiones anteriores; y Percona Server no verifica correctamente que el nombre de host del servidor coincide con un nombre de dominio en el Common Name (CN) del asunto o en el campo subjectAltName del certificado X.509, lo que permite a atacantes man-in-the-middlesuplantar servidores SSL a trav\u00e9s de una cadena \"/CN=\" en un campo en un certificado, seg\u00fan lo demostrado por \"/OU=/CN=bar.com/CN=foo.com\"." } ], "metrics": { "cvssMetricV30": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM" }, "exploitabilityScore": 2.2, "impactScore": 3.6 } ], "cvssMetricV2": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "2.0", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector": "NETWORK", "accessComplexity": "MEDIUM", "authentication": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "availabilityImpact": "NONE", "baseScore": 4.3 }, "baseSeverity": "MEDIUM", "exploitabilityScore": 8.6, "impactScore": 2.9, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false } ] }, "weaknesses": [ { "source": "nvd@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-254" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5.20", "versionEndExcluding": "5.5.47", "matchCriteriaId": "F2EA70BB-425F-4E0F-A618-F72258430EEE" }, { "vulnerable": true, "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.0", "versionEndExcluding": "10.0.23", "matchCriteriaId": "889BD0D7-BB02-4317-A9F1-C6E5E03F16D4" }, { "vulnerable": true, "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.10", "matchCriteriaId": "C682E800-3908-422D-91FE-4C2956691CEB" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*", "matchCriteriaId": "104DA87B-DEE4-4262-AE50-8E6BC43B228B" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5.0", "versionEndIncluding": "5.5.48", "matchCriteriaId": "386760AA-48FC-429A-9206-07B081361BCE" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6.0", "versionEndIncluding": "5.6.29", "matchCriteriaId": "D880856F-559E-43B5-9D46-181D01C0E8B4" }, { "vulnerable": true, "criteria": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7.0", "versionEndIncluding": "5.7.11", "matchCriteriaId": "04D3333B-F3AC-4BB9-9F38-AC0BA9B5B8F7" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*", "matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC" }, { "vulnerable": true, "criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43" }, { "vulnerable": true, "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252" } ] } ] }, { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F" }, { "vulnerable": true, "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084" }, { "vulnerable": true, "criteria": "cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*", "matchCriteriaId": "E88A537F-F4D0-46B9-9E37-965233C2A355" }, { "vulnerable": true, "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B" } ] } ] } ], "references": [ { "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00035.html", "source": "cve@mitre.org", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00053.html", "source": "cve@mitre.org", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00033.html", "source": "cve@mitre.org", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00034.html", "source": "cve@mitre.org", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00051.html", "source": "cve@mitre.org", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00053.html", "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ] }, { "url": "http://rhn.redhat.com/errata/RHSA-2016-0534.html", "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ] }, { "url": "http://rhn.redhat.com/errata/RHSA-2016-0705.html", "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ] }, { "url": "http://rhn.redhat.com/errata/RHSA-2016-1480.html", "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ] }, { "url": "http://rhn.redhat.com/errata/RHSA-2016-1481.html", "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ] }, { "url": "http://www.debian.org/security/2016/dsa-3453", "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ] }, { "url": "http://www.debian.org/security/2016/dsa-3557", "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2016/01/26/3", "source": "cve@mitre.org", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html", "source": "cve@mitre.org", "tags": [ "Patch", "Vendor Advisory" ] }, { "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html", "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ] }, { "url": "http://www.securityfocus.com/bid/81810", "source": "cve@mitre.org", "tags": [ "Third Party Advisory", "VDB Entry" ] }, { "url": "http://www.securitytracker.com/id/1035606", "source": "cve@mitre.org", "tags": [ "Third Party Advisory", "VDB Entry" ] }, { "url": "http://www.ubuntu.com/usn/USN-2953-1", "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ] }, { "url": "http://www.ubuntu.com/usn/USN-2954-1", "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ] }, { "url": "https://access.redhat.com/errata/RHSA-2016:1132", "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ] }, { "url": "https://mariadb.atlassian.net/browse/MDEV-9212", "source": "cve@mitre.org", "tags": [ "Vendor Advisory" ] }, { "url": "https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/", "source": "cve@mitre.org", "tags": [ "Vendor Advisory" ] }, { "url": "https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/", "source": "cve@mitre.org", "tags": [ "Vendor Advisory" ] }, { "url": "https://mariadb.com/kb/en/mdb-10023-rn/", "source": "cve@mitre.org", "tags": [ "Vendor Advisory" ] } ] }