NVD Vulnerability Detail

CVE-2016-2047

Summary	The ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10; Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier; and Percona Server do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "/CN=" string in a field in a certificate, as demonstrated by "/OU=/CN=bar.com/CN=foo.com."
Publication Date	Jan. 28, 2016, 5:59 a.m.
Registration Date	Jan. 26, 2021, 2:08 p.m.
Last Update	Nov. 21, 2024, 11:47 a.m.

CVSS3.0 : MEDIUM
スコア	5.9
Vector	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	高
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	なし
完全性への影響(I)	高
可用性への影響(A)	なし

CVSS2.0 : MEDIUM
Score	4.3
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	低
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:mariadb:mariadb::::::::	10.0.0			10.0.23
cpe:2.3:a:mariadb:mariadb::::::::	10.1.0			10.1.10
cpe:2.3:a:mariadb:mariadb::::::::	5.5.20			5.5.47

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:oracle:linux:7:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:oracle:mysql::::::::	5.6.0	5.6.29
cpe:2.3:a:oracle:mysql::::::::	5.7.0	5.7.11
cpe:2.3:a:oracle:mysql::::::::	5.5.0	5.5.48

Configuration4		or higher	or less	more than	less than
cpe:2.3:o:opensuse:leap:42.1:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*

Configuration6	or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:8.0:::::::*
cpe:2.3:o:debian:debian_linux:9.0:::::::*

Configuration7	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:15.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00035.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00035.html	Mailing List Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00053.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00053.html	Mailing List Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00033.html	Mailing List Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00033.html	Mailing List Third Party Advisory
7	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00034.html	Mailing List Third Party Advisory
8	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00034.html	Mailing List Third Party Advisory
9	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00051.html	Mailing List Third Party Advisory
10	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00051.html	Mailing List Third Party Advisory
11	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00053.html	Third Party Advisory
12	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00053.html	Third Party Advisory
13	http://rhn.redhat.com/errata/RHSA-2016-0534.html	Third Party Advisory
14	http://rhn.redhat.com/errata/RHSA-2016-0534.html	Third Party Advisory
15	http://rhn.redhat.com/errata/RHSA-2016-0705.html	Third Party Advisory
16	http://rhn.redhat.com/errata/RHSA-2016-0705.html	Third Party Advisory
17	http://rhn.redhat.com/errata/RHSA-2016-1480.html	Third Party Advisory
18	http://rhn.redhat.com/errata/RHSA-2016-1480.html	Third Party Advisory
19	http://rhn.redhat.com/errata/RHSA-2016-1481.html	Third Party Advisory
20	http://rhn.redhat.com/errata/RHSA-2016-1481.html	Third Party Advisory
21	http://www.debian.org/security/2016/dsa-3453	Third Party Advisory
22	http://www.debian.org/security/2016/dsa-3453	Third Party Advisory
23	http://www.debian.org/security/2016/dsa-3557	Third Party Advisory
24	http://www.debian.org/security/2016/dsa-3557	Third Party Advisory
25	http://www.openwall.com/lists/oss-security/2016/01/26/3	Mailing List Third Party Advisory
26	http://www.openwall.com/lists/oss-security/2016/01/26/3	Mailing List Third Party Advisory
27	http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html	Patch Vendor Advisory
28	http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html	Patch Vendor Advisory
29	http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html	Third Party Advisory
30	http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html	Third Party Advisory
31	http://www.securityfocus.com/bid/81810	Third Party Advisory VDB Entry
32	http://www.securityfocus.com/bid/81810	Third Party Advisory VDB Entry
33	http://www.securitytracker.com/id/1035606	Third Party Advisory VDB Entry
34	http://www.securitytracker.com/id/1035606	Third Party Advisory VDB Entry
35	http://www.ubuntu.com/usn/USN-2953-1	Third Party Advisory
36	http://www.ubuntu.com/usn/USN-2953-1	Third Party Advisory
37	http://www.ubuntu.com/usn/USN-2954-1	Third Party Advisory
38	http://www.ubuntu.com/usn/USN-2954-1	Third Party Advisory
39	https://access.redhat.com/errata/RHSA-2016:1132	Third Party Advisory
40	https://access.redhat.com/errata/RHSA-2016:1132	Third Party Advisory
41	https://mariadb.atlassian.net/browse/MDEV-9212	Vendor Advisory
42	https://mariadb.atlassian.net/browse/MDEV-9212	Vendor Advisory
43	https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/	Vendor Advisory
44	https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/	Vendor Advisory
45	https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/	Vendor Advisory
46	https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/	Vendor Advisory
47	https://mariadb.com/kb/en/mdb-10023-rn/	Vendor Advisory
48	https://mariadb.com/kb/en/mdb-10023-rn/	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-254	セキュリティ機能	https://cwe.mitre.org/data/definitions/254.html

JVN Vulnerability Information

MariaDB などの製品の sql-common/client.c の ssl_verify_server_cert 関数における SSL サーバになりすまされる脆弱性

Title	MariaDB などの製品の sql-common/client.c の ssl_verify_server_cert 関数における SSL サーバになりすまされる脆弱性
Summary	MariaDB、Oracle MySQL、および Percona Server の sql-common/client.c の ssl_verify_server_cert 関数は、サーバのホスト名が X.509 証明書のサブジェクトの Common Name (CN) または subjectAltName フィールドのドメイン名と一致することを適切に検証しないため、SSL サーバになりすまされる脆弱性が存在します。補足情報 : CWE による脆弱性タイプは、CWE-254: Security Features (セキュリティ機能) と識別されています。 http://cwe.mitre.org/data/definitions/254.html
Possible impacts	中間者攻撃 (man-in-the-middle attack) により、証明書のフィールドの "/CN=" 文字列を介して、SSL サーバになりすまされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 26, 2016, midnight
Registration Date	Feb. 10, 2016, 12:32 p.m.
Last Update	Dec. 9, 2016, 4:05 p.m.

Affected System

レッドハット

Red Hat Enterprise Linux Desktop (v. 7)

Red Hat Enterprise Linux HPC Node (v. 7)

Red Hat Enterprise Linux HPC Node EUS (v. 7.2)

Red Hat Enterprise Linux Server (v. 7)

Red Hat Enterprise Linux Server AUS (v. 7.2)

Red Hat Enterprise Linux Server EUS (v. 7.2)

Red Hat Enterprise Linux Workstation (v. 7)

Red Hat Software Collections 1 for RHEL

オラクル

MySQL 5.5.48 およびそれ以前

MySQL 5.6.29 およびそれ以前

MySQL 5.7.11 およびそれ以前

Oracle Linux

openSUSE project

openSUSE Leap

MariaDB Corporation Ab.

MariaDB 10.0.23 未満の 10.0.x

MariaDB 10.1.10 未満の 10.1.x

MariaDB 5.5.47 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-2047	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2047
National Vulnerability Database (NVD)
2	CVE-2016-2047	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2047

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-Other	https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther

ベンダー情報

No	Name	URL
AskMonty Knowledgebase
1	MariaDB 10.0.23 Release Notes	https://mariadb.com/kb/en/mdb-10023-rn/
2	MariaDB 10.1.10 Release Notes	https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/
3	MariaDB 5.5.47 Release Notes	https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/
Debian Security Advisory
4	DSA-3453	http://www.debian.org/security/2016/dsa-3453
MariaDB Development
5	MDEV-9212	https://mariadb.atlassian.net/browse/MDEV-9212
opensuse-security-announce
6	openSUSE-SU-2016:1332	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00053.html
7	openSUSE-SU-2016:1686	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00053.html
Oracle Critical Patch Update
8	Oracle Critical Patch Update Advisory - April 2016	http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
9	Oracle Critical Patch Update CVSS V2 Risk Matrices - April 2016	http://www.oracle.com/technetwork/topics/security/cpuapr2016-2881694.html
10	Oracle Linux Bulletin - April 2016	http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
11	Text Form of Oracle Critical Patch Update - April 2016 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuapr2016verbose-2881709.html
Red Hat Security Advisory
12	RHSA-2016:0534	http://rhn.redhat.com/errata/RHSA-2016-0534.html
13	RHSA-2016:0705	http://rhn.redhat.com/errata/RHSA-2016-0705.html
SECURITY BLOG
14	April 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/april_2016_critical_patch_update

その他

No	Name	URL
関連文書
1	Flaw in mariadb clients SSL certificate validation	http://www.openwall.com/lists/oss-security/2016/01/26/3

Change Log

No	Changed Details	Date of change
0	[2016年02月10日] 掲載 [2016年05月31日] CVSS による深刻度：内容を更新影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update CVSS V2 Risk Matrices - April 2016) を追加ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - April 2016) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - April 2016 Risk Matrices) を追加ベンダ情報：オラクル (April 2016 Critical Patch Update Released) を追加ベンダ情報：レッドハット (RHSA-2016:0534) を追加 [2016年10月28日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：openSUSE project (openSUSE-SU-2016:1686) を追加ベンダ情報：オラクル (Oracle Linux Bulletin - April 2016) を追加ベンダ情報：レッドハット (RHSA-2016:0705) を追加 [2016年12月09日] 影響を受けるシステム：内容を更新ベンダ情報：openSUSE project (openSUSE-SU-2016:1332) を追加	Feb. 17, 2018, 10:37 a.m.