Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: General). Supported versions that are affected are 7.2.25 and earlier, 7.3.14 and earlier and 7.4.12 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS v3.0 Base Score 3.7 (Availability impacts).

The version of MySQL Cluster running on the remote host is 7.4.x prior to 7.4.13. It is, therefore, affected by multiple vulnerabilities :

  - An overflow condition exists in the NDBAPI subcomponent     that allows an unauthenticated, remote attacker to     update, insert, or delete arbitrary data.
    (CVE-2016-5541)

  - An overflow condition exists in the NDBAPI subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2017-3322)

  - An unspecified flaw exists in the General subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2017-3323)

The version of MySQL Cluster running on the remote host is 7.3.x prior to 7.3.15. It is, therefore, affected by multiple vulnerabilities :

  - An overflow condition exists in the NDBAPI subcomponent     that allows an unauthenticated, remote attacker to     update, insert, or delete arbitrary data.
    (CVE-2016-5541)

  - An overflow condition exists in the NDBAPI subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2017-3322)

  - An unspecified flaw exists in the General subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2017-3323)

The version of MySQL Cluster running on the remote host is 7.2.x prior to 7.2.26. It is, therefore, affected by multiple denial of service vulnerabilities :

  - An overflow condition exists in the NDBAPI subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2017-3322)

  - An unspecified flaw exists in the General subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2017-3323)

ID	Name	Product	Family	Severity
96728	MySQL Cluster 7.4.x < 7.4.13 Multiple Vulnerabilities (January 2017 CPU)	Nessus	Databases	medium
96726	MySQL Cluster 7.3.x < 7.3.15 Multiple Vulnerabilities (January 2017 CPU)	Nessus	Databases	medium
96724	MySQL Cluster 7.2.x < 7.2.26 Multiple DoS (January 2017 CPU)	Nessus	Databases	low

Detections

Analytics

CVE-2017-3323

low

Tenable Plugins

medium

medium

low