MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is not properly handled when processing the binary representation of this feature, related to a numeric calculation error.

The version of MariaDB installed on the remote host is prior to 10.0.4. It is, therefore, affected by multiple vulnerabilities as referenced in the mariadb-10-0-4-release-notes advisory.

  - MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle     MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a     denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is     not properly handled when processing the binary representation of this feature, related to a numeric     calculation error. (CVE-2013-1861)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier allows remote     authenticated users to affect availability via unknown vectors related to Server Parser. (CVE-2013-3783)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and     earlier allows remote authenticated users to affect availability via unknown vectors related to Data     Manipulation Language. (CVE-2013-3793)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.69 and earlier, 5.5.31 and     earlier, and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown     vectors related to Full Text Search. (CVE-2013-3802)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.69 and earlier, 5.5.31 and     earlier, and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown     vectors related to Server Optimizer. (CVE-2013-3804)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and     earlier allows remote authenticated users to affect integrity via unknown vectors related to Audit Log.
    (CVE-2013-3809)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and     earlier allows remote authenticated users to affect availability via unknown vectors related to Server     Replication. (CVE-2013-3812)

  - Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote     authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0502)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Solaris system is missing necessary patches to address security updates :

  - MySQL before 5.0.67 allows local users to bypass certain     privilege checks by calling CREATE TABLE on a MyISAM     table with modified (1) DATA DIRECTORY or (2) INDEX     DIRECTORY arguments that are originally associated with     pathnames without symlinks, and that can point to tables     created at a future time at which a pathname is modified     to contain a symlink to a subdirectory of the MySQL home     data directory. NOTE: this vulnerability exists because     of an incomplete fix for CVE-2008-4097. (CVE-2008-4098)

  - sql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x     through 5.1.41, and 6.0 before 6.0.9-alpha, when the     data home directory contains a symlink to a different     filesystem, allows remote authenticated users to bypass     intended access restrictions by calling CREATE TABLE     with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY     argument referring to a subdirectory that requires     following this symlink. (CVE-2008-7247)

  - MySQL before 5.1.46 allows local users to delete the     data and index files of another user's MyISAM table via     a symlink attack in conjunction with the DROP TABLE     command, a different vulnerability than CVE-2008-4098     and CVE-2008-7247. (CVE-2010-1626)

  - MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x     before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL     5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and     earlier allows remote attackers to cause a denial of     service (crash) via a crafted geometry feature that     specifies a large number of points, which is not     properly handled when processing the binary     representation of this feature, related to a numeric     calculation error. (CVE-2013-1861)

The remote host is affected by the vulnerability described in GLSA-201409-04 (MySQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MySQL. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly gain escalated privileges. A remote       attacker could send a specially crafted SQL query, possibly resulting in       a Denial of Service condition. A remote attacker could entice a user to       connect to specially crafted MySQL server, possibly resulting in       execution of arbitrary code with the privileges of the process.
  Workaround :

    There is no known workaround at this time.

The version of MariaDB 5.5 running on the remote host is a version prior to 5.5.32. It is, therefore, potentially affected by the following vulnerabilities :

  - Errors exist related to the following subcomponents :
    Audit Log, Data Manipulation Language, Full Text Search,     GIS, Server Optimizer, Server Parser and     Server Replication. (CVE-2013-1861, CVE-2013-3783,     CVE-2013-3793, CVE-2013-3802, CVE-2013-3804,     CVE-2013-3809, CVE-2013-3812)

  - Errors exist in the files 'sql/item_func.cc',     'sql/item_sum.cc', 'sql/item_timefunc.cc',     'sql/opt_range.cc', 'sql/sql_derived.cc',     'sql/sql_insert.cc', 'sql/sql_select.cc',     'sql/sql_table.cc', 'sql/table.cc' and     'storage/innobase/mem/mem0mem.c' that could allow     denial of service attacks.

  - Errors exist in the functions or methods 'CONVERT_TZ     Item_func_min_max::get_date', 'my_decimal2decimal',     'setup_ref_array' and 'st_select_lex::nest_last_join'     that could allow denial of service attacks.

  - A buffer overflow error exists in the file     'sql/opt_range.cc' in the function     'QUICK_GROUP_MIN_MAX_SELECT::next_min' that could allow     denial of service attacks and possibly arbitrary code     execution

  - An unspecified issue exists in the file 'dbug/dbug.c'     in the macro 'str_to_buf' that has an unspecified     impact.

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to a new upstream version, 5.5.33, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see the MySQL 5.5 Release Notes for further details :

  -     http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-     32.html
  -     http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-     33.html

In addition this update fixes two issues affecting specifically the mysql-5.5 Debian package :

A race condition in the post-installation script of the mysql-server-5.5 package creates the configuration file '/etc/mysql/debian.cnf' with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as credentials for the debian-sys-maint to perform administration tasks. (CVE-2013-2162 )

Matthias Reichl reported that the mysql-5.5 package misses the patches applied previous in Debian's mysql-5.1 to drop the database 'test' and the permissions that allow anonymous access, without a password, from localhost to the 'test' database and any databases starting with'test_'. This update reintroduces these patches for the mysql-5.5 package.

Existing databases and permissions are not touched. Please refer to the NEWS file provided with this update for further information.

This version upgrade of mysql to 5.5.33 fixed multiple security issues :

  - CVE-2013-1861 / CVE-2013-3783 / CVE-2013-3793 /     CVE-2013-3794

  - CVE-2013-3795 / CVE-2013-3796 / CVE-2013-3798 /     CVE-2013-3801

  - CVE-2013-3802 / CVE-2013-3804 / CVE-2013-3805 /     CVE-2013-3806

  - CVE-2013-3807 / CVE-2013-3808 / CVE-2013-3809 /     CVE-2013-3810

  - Additionally, it contains numerous bug fixes and     improvements.:. (CVE-2013-3811 / CVE-2013-3812)

  - fixed mysqldump with MySQL 5.0. (bnc#768832)

  - fixed log rights. (bnc#789263 and bnc#803040 and     bnc#792332)

  - binlog disabled in default configuration. (bnc#791863)

  - fixed dependencies for client package. (bnc#780019)

  - minor polishing of spec/installation

  - avoid file conflicts with mytop

  - better fix for hard-coded libdir issue

  - fixed hard-coded plugin paths. (bnc#834028)

  - use chown --no-dereference instead of chown to improve     security. (bnc#834967)

  - adjust to spell !includedir correctly in /etc/my.cnf.
    (bnc#734436)

  - typo in init script stops database on update     (bnc#837801)

This version upgrade of mysql to 5.5.32 fixes multiple security issues :

CVE-2013-1861 / CVE-2013-3783 / CVE-2013-3793 / CVE-2013-3794 / CVE-2013-3795 / CVE-2013-3796 / CVE-2013-3798 / CVE-2013-3801 / CVE-2013-3802 / CVE-2013-3804 / CVE-2013-3805 / CVE-2013-3806 / CVE-2013-3807 / CVE-2013-3808 / CVE-2013-3809 / CVE-2013-3810 / CVE-2013-3811 / CVE-2013-3812

Additionally, it contains numerous bug fixes and improvements. :

  - making mysqldump work with MySQL 5.0. (bnc#768832)

  - fixed log rights. (bnc#789263 and bnc#803040)

  - binlog disabled in default configuration. (bnc#791863)

  - fixed dependencies for client package. (bnc#780019)

  - minor polishing of spec/installation

  - avoiding file conflicts with mytop

  - better fix for hardcoded libdir issue

  - fix hardcoded plugin paths. (bnc#834028)

  - Use chown --no-dereference instead of chown to improve     security. (bnc#834967)

  - Adjust to spell !includedir correctly in /etc/my.cnf     (bnc#734436)

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.1.70 in Ubuntu 10.04 LTS. Ubuntu 12.04 LTS, Ubuntu 12.10 and Ubuntu 13.04 have been updated to MySQL 5.5.32.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-70.html http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-32.html http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.
html.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL 5.6 installed on the remote host is earlier than 5.6.12. Therefore, affected by vulnerabilities in the following components :

 - Audit Log

  - Data Manipulation Language

  - Full Text Search

  - GIS

  - InnoDB

  - MemCached

  - Server Optimizer

  - Server Parser

  - Server Privileges

  - Server Replication

  - XA Transactions

The version of MySQL installed on the remote host is earlier than 5.6.12. Therefore, affected by vulnerabilities in the following components :

 - Audit Log

  - Data Manipulation Language

  - Full Text Search

  - GIS

  - InnoDB

  - MemCached

  - Server Optimizer

  - Server Privileges

  - Server Replication

  - XA Transactions

  - 'Server Options' sub component (for MySQL versions earlier than and up to 5.5.30, as well as 5.6.10)

  - The 'Prepared Statements' sub component (for MySQL versions earlier than and up to 5.5.30, as well as 5.6.10)

The version of MySQL installed on the remote host is 5.6.x older than 5.6.12.  As such, it is reportedly affected by vulnerabilities in the following components :

  - Audit Log
  - Data Manipulation Language
  - Full Text Search
  - GIS
  - InnoDB
  - Locking
  - MemCached
  - Server Optimizer
  - Server Privileges
  - Server Replication
  - XA Transactions

The version of MySQL 5.5.x installed on the remote host is prior to 5.5.32. It is, therefore, affected by multiple vulnerabilities in the following components :

  - Audit Log
  - Data Manipulation Language
  - Full Text Search
  - GIS
  - Server : Optimizer
  - Server : Parser
  - Server : Replication

The version of MySQL 5.1 installed on the remote host is earlier than 5.1.70 and is, therefore, potentially affected by vulnerabilities in the following components :

  - Full Text Search
  - GIS
  - Server Optimizer

This is an update that uses /var/tmp as default tmpdir to prevent potential issues, fixes CVE-2013-1861 and adds some missing command-line options to man-pages.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.1.69 in Ubuntu 10.04 LTS and Ubuntu 11.10.
Ubuntu 12.04 LTS and Ubuntu 12.10 have been updated to MySQL 5.5.31.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-69.html http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-31.html http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.h tml.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
167906	MariaDB 10.0.0 < 10.0.4 Multiple Vulnerabilities	Nessus	Databases	medium
80705	Oracle Solaris Third-Party Patch Update : mysql (multiple_vulnerabilities_in_mysql)	Nessus	Solaris Local Security Checks	medium
77548	GLSA-201409-04 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
72373	MariaDB 5.5 < 5.5.32 Multiple Vulnerabilities	Nessus	Databases	medium
71474	Debian DSA-2818-1 : mysql-5.5 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
70328	SuSE 11.3 Security Update : mysql, mysql-client (SAT Patch Number 8364)	Nessus	SuSE Local Security Checks	medium
69511	SuSE 11.3 Security Update : MySQL (SAT Patch Number 8217)	Nessus	SuSE Local Security Checks	medium
69073	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : mysql-5.5, mysql-dfsg-5.1 vulnerabilities (USN-1909-1)	Nessus	Ubuntu Local Security Checks	medium
801397	MySQL 5.6.x < 5.6.12 Multiple Vulnerabilities	Log Correlation Engine	Database	medium
6934	Oracle MySQL 5.6.x < 5.6.12 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
68939	MySQL 5.6.x < 5.6.12 Multiple Vulnerabilities	Nessus	Databases	medium
68938	MySQL 5.5 < 5.5.32 Multiple Vulnerabilities	Nessus	Databases	medium
68937	MySQL 5.1 < 5.1.70 Multiple Vulnerabilities	Nessus	Databases	medium
67261	Fedora 19 : community-mysql-5.5.31-7.fc19 (2013-10020)	Nessus	Fedora Local Security Checks	medium
66215	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : mysql-5.1, mysql-5.5, mysql-dfsg-5.1 vulnerabilities (USN-1807-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2013-1861

high

Tenable Plugins

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high