bevhost / rpms / mysql-mmm

Forked from rpms/mysql-mmm 6 years ago
Clone

d84a609 Fix TALOS-2017-0501, CVE-2017-14474 - CVE-2017-14481

Authored and Committed by bevhost 6 years ago
    Fix TALOS-2017-0501, CVE-2017-14474 - CVE-2017-14481
    
    Multiple exploitable remote command injection vulnerabilities exist
    in the MySQL Master-Master Replication Manager (MMM) mmm_agentd
    daemon 2.2.1. mmm_agentd commonly runs with root privileges and does not
    require authentication by default.  A specially crafted MMM protocol
    message can cause a shell command injection resulting in arbitrary
    command execution with the privileges of the mmm_agentd process.  An
    attacker that can initiate a TCP session with mmm_agentd can trigger
    these vulnerabilities.
    
        
file modified
+7 -1