Unspecified vulnerability in Oracle MySQL Server 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:INNODB FULLTEXT SEARCH DML.

The version of MariaDB installed on the remote host is prior to 10.0.13. It is, therefore, affected by multiple vulnerabilities as referenced in the mariadb-10013-release-notes advisory, including the following:

  - A flaw in OpenSSL which fails to properly restrict     processing of ChangeCipherSpec messages. A     man-in-the-middle attacker can exploit this, via a     crafted TLS handshake, to force the use of a     zero-length master key in certain OpenSSL-to-OpenSSL     communications, resulting in the session being hijacked     and sensitive information being disclosed.
    (CVE-2014-0224)

 -  A buffer overflow error in OpenSSL related to invalid     DTLS fragment handling that can lead to execution of     arbitrary code or denial of service. This is caused by     improper validation on the fragment lengths in DTLS     ClientHello messages. (CVE-2014-0195)

  - An unspecified vulnerability in MariaDB Server related     to CLIENT:MYSQLDUMP that allows remote, authenticated     users to affect confidentiality, integrity, and     availability. (CVE-2014-6530)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

mariadb was updated to version 10.0.16 to fix 40 security issues.

These security issues were fixed :

  - CVE-2015-0411: Unspecified vulnerability in Oracle MySQL     Server 5.5.40 and earlier, and 5.6.21 and earlier,     allowed remote attackers to affect confidentiality,     integrity, and availability via unknown vectors related     to Server : Security : Encryption (bnc#915911).

  - CVE-2015-0382: Unspecified vulnerability in Oracle MySQL     Server 5.5.40 and earlier and 5.6.21 and earlier allowed     remote attackers to affect availability via unknown     vectors related to Server : Replication, a different     vulnerability than CVE-2015-0381 (bnc#915911).

  - CVE-2015-0381: Unspecified vulnerability in Oracle MySQL     Server 5.5.40 and earlier and 5.6.21 and earlier allowed     remote attackers to affect availability via unknown     vectors related to Server : Replication, a different     vulnerability than CVE-2015-0382 (bnc#915911).

  - CVE-2015-0432: Unspecified vulnerability in Oracle MySQL     Server 5.5.40 and earlier allowed remote authenticated     users to affect availability via vectors related to     Server : InnoDB : DDL : Foreign Key (bnc#915911).

  - CVE-2014-6568: Unspecified vulnerability in Oracle MySQL     Server 5.5.40 and earlier, and 5.6.21 and earlier,     allowed remote authenticated users to affect     availability via vectors related to Server : InnoDB :
    DML (bnc#915911).

  - CVE-2015-0374: Unspecified vulnerability in Oracle MySQL     Server 5.5.40 and earlier and 5.6.21 and earlier allowed     remote authenticated users to affect confidentiality via     unknown vectors related to Server : Security :
    Privileges : Foreign Key (bnc#915911).

  - CVE-2014-6507: Unspecified vulnerability in Oracle MySQL     Server 5.5.39 and earlier, and 5.6.20 and earlier,     allowed remote authenticated users to affect     confidentiality, integrity, and availability via vectors     related to SERVER:DML (bnc#915912).

  - CVE-2014-6491: Unspecified vulnerability in Oracle MySQL     Server 5.5.39 and earlier and 5.6.20 and earlier allowed     remote attackers to affect confidentiality, integrity,     and availability via vectors related to     SERVER:SSL:yaSSL, a different vulnerability than     CVE-2014-6500 (bnc#915912).

  - CVE-2014-6500: Unspecified vulnerability in Oracle MySQL     Server 5.5.39 and earlier, and 5.6.20 and earlier,     allowed remote attackers to affect confidentiality,     integrity, and availability via vectors related to     SERVER:SSL:yaSSL, a different vulnerability than     CVE-2014-6491 (bnc#915912).

  - CVE-2014-6469: Unspecified vulnerability in Oracle MySQL     Server 5.5.39 and eariler and 5.6.20 and earlier allowed     remote authenticated users to affect availability via     vectors related to SERVER:OPTIMIZER (bnc#915912).

  - CVE-2014-6555: Unspecified vulnerability in Oracle MySQL     Server 5.5.39 and earlier and 5.6.20 and earlier allowed     remote authenticated users to affect confidentiality,     integrity, and availability via vectors related to     SERVER:DML (bnc#915912).

  - CVE-2014-6559: Unspecified vulnerability in Oracle MySQL     Server 5.5.39 and earlier, and 5.6.20 and earlier,     allowed remote attackers to affect confidentiality via     vectors related to C API SSL CERTIFICATE HANDLING     (bnc#915912).

  - CVE-2014-6494: Unspecified vulnerability in Oracle MySQL     Server 5.5.39 and earlier, and 5.6.20 and earlier,     allowed remote attackers to affect availability via     vectors related to CLIENT:SSL:yaSSL, a different     vulnerability than CVE-2014-6496 (bnc#915912).

  - CVE-2014-6496: Unspecified vulnerability in Oracle MySQL     Server 5.5.39 and earlier, and 5.6.20 and earlier,     allowed remote attackers to affect availability via     vectors related to CLIENT:SSL:yaSSL, a different     vulnerability than CVE-2014-6494 (bnc#915912).

  - CVE-2014-6464: Unspecified vulnerability in Oracle MySQL     Server 5.5.39 and earlier and 5.6.20 and earlier allowed     remote authenticated users to affect availability via     vectors related to SERVER:INNODB DML FOREIGN KEYS     (bnc#915912).

  - CVE-2010-5298: Race condition in the ssl3_read_bytes     function in s3_pkt.c in OpenSSL through 1.0.1g, when     SSL_MODE_RELEASE_BUFFERS is enabled, allowed remote     attackers to inject data across sessions or cause a     denial of service (use-after-free and parsing error) via     an SSL connection in a multithreaded environment     (bnc#873351).

  - CVE-2014-0195: The dtls1_reassemble_fragment function in     d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before     1.0.0m, and 1.0.1 before 1.0.1h did not properly     validate fragment lengths in DTLS ClientHello messages,     which allowed remote attackers to execute arbitrary code     or cause a denial of service (buffer overflow and     application crash) via a long non-initial fragment     (bnc#880891).

  - CVE-2014-0198: The do_ssl3_write function in s3_pkt.c in     OpenSSL 1.x through 1.0.1g, when     SSL_MODE_RELEASE_BUFFERS is enabled, did not properly     manage a buffer pointer during certain recursive calls,     which allowed remote attackers to cause a denial of     service (NULL pointer dereference and application crash)     via vectors that trigger an alert condition     (bnc#876282).

  - CVE-2014-0221: The dtls1_get_message_fragment function     in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before     1.0.0m, and 1.0.1 before 1.0.1h allowed remote attackers     to cause a denial of service (recursion and client     crash) via a DTLS hello message in an invalid DTLS     handshake (bnc#915913).

  - CVE-2014-0224: OpenSSL before 0.9.8za, 1.0.0 before     1.0.0m, and 1.0.1 before 1.0.1h did not properly     restrict processing of ChangeCipherSpec messages, which     allowed man-in-the-middle attackers to trigger use of a     zero-length master key in certain OpenSSL-to-OpenSSL     communications, and consequently hijack sessions or     obtain sensitive information, via a crafted TLS     handshake, aka the 'CCS Injection' vulnerability     (bnc#915913).

  - CVE-2014-3470: The ssl3_send_client_key_exchange     function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0     before 1.0.0m, and 1.0.1 before 1.0.1h, when an     anonymous ECDH cipher suite is used, allowed remote     attackers to cause a denial of service (NULL pointer     dereference and client crash) by triggering a NULL     certificate value (bnc#915913).

  - CVE-2014-6474: Unspecified vulnerability in Oracle MySQL     Server 5.6.19 and earlier allowed remote authenticated     users to affect availability via vectors related to     SERVER:MEMCACHED (bnc#915913).

  - CVE-2014-6489: Unspecified vulnerability in Oracle MySQL     Server 5.6.19 and earlier allowed remote authenticated     users to affect integrity and availability via vectors     related to SERVER:SP (bnc#915913).

  - CVE-2014-6564: Unspecified vulnerability in Oracle MySQL     Server 5.6.19 and earlier allowed remote authenticated     users to affect availability via vectors related to     SERVER:INNODB FULLTEXT SEARCH DML (bnc#915913).

  - CVE-2012-5615: Oracle MySQL 5.5.38 and earlier, 5.6.19     and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13,     5.1.66, and possibly other versions, generates different     error messages with different time delays depending on     whether a user name exists, which allowed remote     attackers to enumerate valid usernames (bnc#915913).

  - CVE-2014-4274: Unspecified vulnerability in Oracle MySQL     Server 5.5.38 and earlier and 5.6.19 and earlier allowed     local users to affect confidentiality, integrity, and     availability via vectors related to SERVER:MyISAM     (bnc#896400).

  - CVE-2014-4287: Unspecified vulnerability in Oracle MySQL     Server 5.5.38 and earlier and 5.6.19 and earlier allowed     remote authenticated users to affect availability via     vectors related to SERVER:CHARACTER SETS (bnc#915913).

  - CVE-2014-6463: Unspecified vulnerability in Oracle MySQL     Server 5.5.38 and earlier and 5.6.19 and earlier allowed     remote authenticated users to affect availability via     vectors related to SERVER:REPLICATION ROW FORMAT BINARY     LOG DML (bnc#915913).

  - CVE-2014-6478: Unspecified vulnerability in Oracle MySQL     Server 5.5.38 and earlier, and 5.6.19 and earlier,     allowed remote attackers to affect integrity via vectors     related to SERVER:SSL:yaSSL (bnc#915913).

  - CVE-2014-6484: Unspecified vulnerability in Oracle MySQL     Server 5.5.38 and earlier, and 5.6.19 and earlier,     allowed remote authenticated users to affect     availability via vectors related to SERVER:DML     (bnc#915913).

  - CVE-2014-6495: Unspecified vulnerability in Oracle MySQL     Server 5.5.38 and earlier, and 5.6.19 and earlier,     allowed remote attackers to affect availability via     vectors related to SERVER:SSL:yaSSL (bnc#915913).

  - CVE-2014-6505: Unspecified vulnerability in Oracle MySQL     Server 5.5.38 and earlier, and 5.6.19 and earlier,     allowed remote authenticated users to affect     availability via vectors related to SERVER:MEMORY     STORAGE ENGINE (bnc#915913).

  - CVE-2014-6520: Unspecified vulnerability in Oracle MySQL     Server 5.5.38 and earlier allowed remote authenticated     users to affect availability via vectors related to     SERVER:DDL (bnc#915913).

  - CVE-2014-6530: Unspecified vulnerability in Oracle MySQL     Server 5.5.38 and earlier, and 5.6.19 and earlier,     allowed remote authenticated users to affect     confidentiality, integrity, and availability via vectors     related to CLIENT:MYSQLDUMP (bnc#915913).

  - CVE-2014-6551: Unspecified vulnerability in Oracle MySQL     Server 5.5.38 and earlier and 5.6.19 and earlier allowed     local users to affect confidentiality via vectors     related to CLIENT:MYSQLADMIN (bnc#915913).

  - CVE-2015-0391: Unspecified vulnerability in Oracle MySQL     Server 5.5.38 and earlier, and 5.6.19 and earlier,     allowed remote authenticated users to affect     availability via vectors related to DDL (bnc#915913).

  - CVE-2014-4258: Unspecified vulnerability in the MySQL     Server component in Oracle MySQL 5.5.37 and earlier and     5.6.17 and earlier allowed remote authenticated users to     affect confidentiality, integrity, and availability via     vectors related to SRINFOSC (bnc#915914).

  - CVE-2014-4260: Unspecified vulnerability in the MySQL     Server component in Oracle MySQL 5.5.37 and earlier, and     5.6.17 and earlier, allowed remote authenticated users     to affect integrity and availability via vectors related     to SRCHAR (bnc#915914).

  - CVE-2014-2494: Unspecified vulnerability in the MySQL     Server component in Oracle MySQL 5.5.37 and earlier     allowed remote authenticated users to affect     availability via vectors related to ENARC (bnc#915914).

  - CVE-2014-4207: Unspecified vulnerability in the MySQL     Server component in Oracle MySQL 5.5.37 and earlier     allowed remote authenticated users to affect     availability via vectors related to SROPTZR     (bnc#915914).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The MySQL datebase server was updated to 5.5.42, fixing various bugs and security issues.

More information can be found on :

  -     http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-     42.html

  -     http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-     41.html

  -     http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-     40.html Also various issues with the mysql start script     were fixed. (bsc#868673,bsc#878779)

The version of MySQL installed on the remote host is version 5.6.x prior to 5.6.20. It is, therefore, affected by errors in the following components :

 - SERVER:SP (CVE-2014-6489)
 - SERVER INNODB FULLTEXT SEARCH (CVE-2014-6564)
 - SERVER:MEMCACHED (CVE-2014-6474)

This is an update that fixes all issues described at https://mariadb.com/kb/en/mariadb/development/changelogs/mariadb-5540- changelog and also couple of security issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL installed on the remote host is version 5.6.x prior to 5.6.20. It is, therefore, affected by errors in the following components :

  - CLIENT:MYSQLADMIN
  - CLIENT:MYSQLDUMP
  - SERVER:CHARACTER SETS
  - SERVER:DML
  - SERVER:MEMORY STORAGE ENGINE
  - SERVER:MyISAM
  - SERVER:PRIVILEGES AUTHENTICATION PLUGIN API
  - SERVER:REPLICATION ROW FORMAT BINARY LOG DML
  - SERVER:SSL:OpenSSL
  - SERVER:SSL:yaSSL

ID	Name	Product	Family	Severity
129359	MariaDB 10.0.0 < 10.0.13 Multiple Vulnerabilities	Nessus	Databases	high
83716	SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2015:0743-1)	Nessus	SuSE Local Security Checks	high
82428	SuSE 11.3 Security Update : MySQL (SAT Patch Number 10387)	Nessus	SuSE Local Security Checks	high
8917	Oracle MySQL 5.6.x < 5.6.20 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
79905	Fedora 20 : mariadb-5.5.40-1.fc20 (2014-16003)	Nessus	Fedora Local Security Checks	medium
77670	MySQL 5.6.x < 5.6.20 Multiple Vulnerabilities (October 2014 CPU)	Nessus	Databases	medium

Detections

Analytics

CVE-2014-6564

medium

Tenable Plugins

high

high

high

medium

medium

medium