CVE-2015-1027

The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Middle attacks in which the server response could be modified to allow the attacker to respond with modified command payload and have the client return additional running configuration information leading to an information disclosure of running configuration of MySQL.

CVSS v3 5.9 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://bugs.launchpad.net/percona-toolkit/+bug/1408375	Issue Tracking Third Party Advisory
https://www.percona.com/blog/2015/05/06/percona-security-advisory-cve-2015-1027/	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:percona:toolkit::::::::
	cpe:2.3:a:percona:xtrabackup::::::::

History

No history.

Information

Published : 2017-09-29 01:34

Updated : 2023-12-10 12:15

NVD link : CVE-2015-1027

Mitre link : CVE-2015-1027

CVE.ORG link : CVE-2015-1027

JSON object : View

Products Affected

percona

toolkit
xtrabackup

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2015-1027", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2017-09-29T01:34:47.907", "references": [{"url": "https://bugs.launchpad.net/percona-toolkit/+bug/1408375", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.percona.com/blog/2015/05/06/percona-security-advisory-cve-2015-1027/", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Middle attacks in which the server response could be modified to allow the attacker to respond with modified command payload and have the client return additional running configuration information leading to an information disclosure of running configuration of MySQL."}, {"lang": "es", "value": "La subrutina de chequeo de versiones en percona-toolkit en versiones anteriores a la 2.2.13 y xtrabackup en versiones anteriores a la 2.2.9 era vulnerable a ataques silenciosos de degradaci\u00f3n HTTP y Man-in-the-Middle (MitM) en los que la respuesta del servidor se podr\u00eda modificar para que permita que el atacante responda con una carga \u00fatil de comandos modificada y fuerce a que el cliente devuelva informaci\u00f3n adicional de la configuraci\u00f3n que se est\u00e1 ejecutando, lo cual provocar\u00eda la revelaci\u00f3n de informaci\u00f3n de la configuraci\u00f3n actual de MySQL."}], "lastModified": "2017-10-10T11:56:09.433", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:percona:toolkit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75B5EE03-4299-4C10-94BC-81A09FBFBB98", "versionEndIncluding": "2.2.12"}, {"criteria": "cpe:2.3:a:percona:xtrabackup:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "621D642F-7ED5-490E-9B02-E0CB62570E2D", "versionEndIncluding": "2.2.8"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}