Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: NDBAPI). Supported versions that are affected are 7.2.26 and earlier, 7.3.14 and earlier and 7.4.12 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS v3.0 Base Score 4.8 (Integrity and Availability impacts).

The version of MySQL Cluster running on the remote host is 7.4.x prior to 7.4.13. It is, therefore, affected by multiple vulnerabilities :

  - An overflow condition exists in the NDBAPI subcomponent     that allows an unauthenticated, remote attacker to     update, insert, or delete arbitrary data.
    (CVE-2016-5541)

  - An overflow condition exists in the NDBAPI subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2017-3322)

  - An unspecified flaw exists in the General subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2017-3323)

The version of MySQL Cluster running on the remote host is 7.3.x prior to 7.3.15. It is, therefore, affected by multiple vulnerabilities :

  - An overflow condition exists in the NDBAPI subcomponent     that allows an unauthenticated, remote attacker to     update, insert, or delete arbitrary data.
    (CVE-2016-5541)

  - An overflow condition exists in the NDBAPI subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2017-3322)

  - An unspecified flaw exists in the General subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2017-3323)

The version of MySQL Cluster running on the remote host is 7.2.x prior to 7.2.27. It is, therefore, affected by an overflow condition in the NDBAPI subcomponent that allows an unauthenticated, remote attacker to update, insert, or delete arbitrary data.

ID	Name	Product	Family	Severity
96728	MySQL Cluster 7.4.x < 7.4.13 Multiple Vulnerabilities (January 2017 CPU)	Nessus	Databases	medium
96726	MySQL Cluster 7.3.x < 7.3.15 Multiple Vulnerabilities (January 2017 CPU)	Nessus	Databases	medium
96725	MySQL Cluster 7.2.x < 7.2.27 NDBAPI Subcomponent Buffer Overflow (January 2017 CPU)	Nessus	Databases	medium

Detections

Analytics

CVE-2016-5541

medium

Tenable Plugins

medium

medium

medium