CVE-2021-35644 : Exploit Details and Defense Strategies

A vulnerability has been identified in the MySQL Server product of Oracle MySQL, specifically in the Server Optimizer component. Attackers with high privileges and network access to MySQL Server versions 8.0.26 and earlier can exploit this vulnerability, potentially leading to a denial of service (DOS) attack.

Understanding CVE-2021-35644

This section provides an overview of the CVE-2021-35644 vulnerability, its impact, technical details, and mitigation steps.

What is CVE-2021-35644?

The vulnerability lies in the MySQL Server product of Oracle MySQL, affecting versions 8.0.26 and prior. Exploitation of this vulnerability by a high-privileged attacker with network access through multiple protocols can compromise MySQL Server, resulting in a denial of service.

The Impact of CVE-2021-35644

Successful attacks on this vulnerability can give unauthorized access to attackers, enabling them to cause the MySQL Server to hang or crash repetitively, leading to a complete denial of service condition. The CVSS 3.1 Base Score of this vulnerability is 4.9, indicating medium severity with high availability impact.

Technical Details of CVE-2021-35644

This section delves deeper into the technical aspects of CVE-2021-35644, including vulnerability description, affected systems, and the exploitation mechanism.

Vulnerability Description

The vulnerability allows a high-privileged attacker with network access to compromise MySQL Server versions 8.0.26 and earlier, potentially causing a denial of service by inducing hang or frequent crashes.

Affected Systems and Versions

The vulnerability affects Oracle MySQL Server versions 8.0.26 and prior.

Exploitation Mechanism

Attackers with high privileges and network access can exploit this vulnerability through multiple protocols, compromising the MySQL Server.

Mitigation and Prevention

This section outlines the steps to mitigate the risk posed by CVE-2021-35644, ensuring the security of MySQL Server installations.

Immediate Steps to Take

Update MySQL Server to a patched version that addresses CVE-2021-35644.
Monitor for any unusual activity on MySQL Server that could indicate an ongoing exploitation attempt.

Long-Term Security Practices

Implement strict access controls to limit privileges on MySQL Server.
Maintain regular security updates and patches for MySQL Server to protect against known vulnerabilities.

Patching and Updates

Regularly check for security advisories from Oracle Corporation and apply patches promptly to ensure the security of MySQL Server.