Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier and MariaDB 10.0.x before 10.0.24 and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to InnoDB.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1132 advisory.

  - pcre: buffer overflow caused by recursive back reference by name within certain group (8.38/4)     (CVE-2015-3210, CVE-2015-8384)

  - pcre: stack overflow caused by mishandled group empty match (8.38/11) (CVE-2015-3217)

  - mysql: unspecified vulnerability related to Server:Partition (CPU October 2015) (CVE-2015-4792,     CVE-2015-4802)

  - mysql: unspecified vulnerability related to Server:DDL (CPU October 2015) (CVE-2015-4815)

  - mysql: unspecified vulnerability related to Server:InnoDB (CPU October 2015) (CVE-2015-4816,     CVE-2015-4861, CVE-2015-4895)

  - mysql: unspecified vulnerability related to Client programs (CPU October 2015) (CVE-2015-4819)

  - mysql: unspecified vulnerability related to Server:Types (CPU October 2015) (CVE-2015-4826)

  - mysql: unspecified vulnerability related to Server:Security:Privileges (CPU October 2015) (CVE-2015-4830)

  - mysql: unspecified vulnerability related to Server:SP (CPU October 2015) (CVE-2015-4836)

  - mysql: unspecified vulnerability related to Server:DML (CPU October 2015) (CVE-2015-4858, CVE-2015-4879,     CVE-2015-4913)

  - mysql: unspecified vulnerability related to Server:Parser (CPU October 2015) (CVE-2015-4870)

  - pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis     (8.38/18) (CVE-2015-5073, CVE-2015-8388)

  - pcre: Buffer overflow caused by duplicate named references (8.38/36) (CVE-2015-8381, CVE-2015-8395)

  - pcre: Buffer overflow caused by repeated conditional group (8.38/3) (CVE-2015-8383)

  - pcre: buffer overflow caused by named forward reference to duplicate group number (8.38/30)     (CVE-2015-8385)

  - pcre: Buffer overflow caused by lookbehind assertion (8.38/6) (CVE-2015-8386)

  - pcre: inefficient posix character class syntax check (8.38/16) (CVE-2015-8391)

  - pcre: buffer overflow caused by patterns with duplicated named groups with (?| (8.38/27) (CVE-2015-8392)

  - mysql: unspecified vulnerability in subcomponent: Server: Options (CPU January 2016) (CVE-2016-0505)

  - mysql: unspecified vulnerability in subcomponent: Client (CPU January 2016) (CVE-2016-0546)

  - mysql: unspecified vulnerability in subcomponent: Server: DML (CPU January 2016) (CVE-2016-0596,     CVE-2016-0598)

  - mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU January 2016) (CVE-2016-0597,     CVE-2016-0616)

  - mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU January 2016) (CVE-2016-0600,     CVE-2016-0610)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU January 2016)     (CVE-2016-0606)

  - mysql: unspecified vulnerability in subcomponent: Server: UDF (CPU January 2016) (CVE-2016-0608)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU January 2016)     (CVE-2016-0609)

  - mysql: unspecified vulnerability in subcomponent: Server: DML (CPU April 2016) (CVE-2016-0640,     CVE-2016-0643, CVE-2016-0646)

  - mysql: unspecified vulnerability in subcomponent: Server: MyISAM (CPU April 2016) (CVE-2016-0641)

  - mysql: unspecified vulnerability in subcomponent: Server: Federated (CPU April 2016) (CVE-2016-0642)

  - mysql: unspecified vulnerability in subcomponent: Server: DDL (CPU April 2016) (CVE-2016-0644)

  - mysql: unspecified vulnerability in subcomponent: Server: FTS (CPU April 2016) (CVE-2016-0647)

  - mysql: unspecified vulnerability in subcomponent: Server: PS (CPU April 2016) (CVE-2016-0648,     CVE-2016-0649)

  - mysql: unspecified vulnerability in subcomponent: Server: Replication (CPU April 2016) (CVE-2016-0650)

  - mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016) (CVE-2016-0651)

  - mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU April 2016) (CVE-2016-0655,     CVE-2016-0668)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU April 2016)     (CVE-2016-0666)

  - pcre: heap buffer overflow in handling of duplicate named groups (8.39/14) (CVE-2016-1283)

  - mysql: ssl-validate-cert incorrect hostname check (CVE-2016-2047)

  - pcre: workspace overflow for (*ACCEPT) with deeply nested parentheses (8.39/13, 10.22/12) (CVE-2016-3191)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU July 2016)     (CVE-2016-3452)

  - mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU July 2016) (CVE-2016-3459)

  - mysql: unspecified vulnerability in subcomponent: Server: Option (CPU July 2016) (CVE-2016-3471)

  - mysql: unspecified vulnerability in subcomponent: Server: Connection (CPU July 2016) (CVE-2016-5444)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MariaDB running on the remote host is 10.1.x prior to 10.1.12. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to impact     integrity and availability. (CVE-2016-0640)

  - An unspecified flaw exists in the MyISAM subcomponent     that allows an authenticated, remote attacker to     disclose sensitive information or cause a denial of     service condition. (CVE-2016-0641)

  - An unspecified flaw exists in the DDL subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0644)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0646)

  - An unspecified flaw exists in the PS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0649)

  - An unspecified flaw exists in the Replication     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-0650)

  - An unspecified flaw exists in the InnoDB subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0668)

  - A denial of service vulnerability exists in the     SELECT_LEX::update_used_tables() function in sql_lex.cc     due to improper handling of semi-join conditions on used     table updates. An authenticated, remote attacker can     exploit this to crash the database.

  - A denial of service vulnerability exists in the     JOIN::choose_subquery_plan() function in     opt_subselect.cc due to improper handling of nested IN     clauses that contain SQ. An authenticated, remote     attacker can exploit this to crash the database.

  - A denial of service vulnerability exists in the     select_create::prepare() function in sql_insert.cc due     to improper handling of stored procedures in new tables.
    An authenticated, remote attacker can exploit this to     crash the database.

  - A denial of service vulnerability exists in     item_cmpfunc.cc due to improper handling of EXECUTE     statements. An authenticated, remote attacker can     exploit this to crash the database.

  - A denial of service vulnerability exists in the     subselect_hash_sj_engine::exec() function in     item_subselect.cc due to improper handling of UNION ALL     statements. An authenticated, remote attacker can     exploit this to crash the database.

  - A denial of service vulnerability exists in the     Rows_log_event::process_triggers() function in     log_event.cc due to improper handling of the update     statement for minimal row image sets. An authenticated,     remote attacker can exploit this to crash the database.

  - A denial of service vulnerability exists in     sql_select.cc due to improper creation of keys in     temporary tables. An authenticated, remote attacker can     exploit this to crash the database.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MariaDB running on the remote host is 10.0.x prior to 10.0.24. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to impact     integrity and availability. (CVE-2016-0640)

  - An unspecified flaw exists in the MyISAM subcomponent     that allows an authenticated, remote attacker to     disclose sensitive information or cause a denial of     service condition. (CVE-2016-0641)

  - An unspecified flaw exists in the DDL subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0644)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0646)

  - An unspecified flaw exists in the PS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0649)

  - An unspecified flaw exists in the Replication     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-0650)

  - An unspecified flaw exists in the InnoDB subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0668)

  - A denial of service vulnerability exists in the     SELECT_LEX::update_used_tables() function in sql_lex.cc     due to improper handling of semi-join conditions on used     table updates. An authenticated, remote attacker can     exploit this to crash the database.

  - A denial of service vulnerability exists in the     JOIN::choose_subquery_plan() function in     opt_subselect.cc due to improper handling of nested IN     clauses that contain SQ. An authenticated, remote     attacker can exploit this to crash the database.

  - A denial of service vulnerability exists in the     select_create::prepare() function in sql_insert.cc due     to improper handling of stored procedures in new tables.
    An authenticated, remote attacker can exploit this to     crash the database.

  - A denial of service vulnerability exists in     sql_select.cc due to improper creation of keys in     temporary tables. An authenticated, remote attacker can     exploit this to crash the database.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

mariadb was updated to version 10.0.25 to fix 25 security issues.

These security issues were fixed :

  - CVE-2016-0505: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Options (bsc#980904).

  - CVE-2016-0546: Unspecified vulnerability allowed local     users to affect confidentiality, integrity, and     availability via unknown vectors related to Client     (bsc#980904).

  - CVE-2016-0596: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0597: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Optimizer (bsc#980904).

  - CVE-2016-0598: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0600: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to InnoDB (bsc#980904).

  - CVE-2016-0606: Unspecified vulnerability allowed remote     authenticated users to affect integrity via unknown     vectors related to encryption (bsc#980904).

  - CVE-2016-0608: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to UDF (bsc#980904).

  - CVE-2016-0609: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to privileges (bsc#980904).

  - CVE-2016-0616: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Optimizer (bsc#980904).

  - CVE-2016-0640: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0641: Unspecified vulnerability allowed local     users to affect confidentiality and availability via     vectors related to MyISAM (bsc#980904).

  - CVE-2016-0642: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to Federated (bsc#980904).

  - CVE-2016-0643: Unspecified vulnerability allowed local     users to affect confidentiality via vectors related to     DML (bsc#980904).

  - CVE-2016-0644: Unspecified vulnerability allowed local     users to affect availability via vectors related to DDL     (bsc#980904).

  - CVE-2016-0646: Unspecified vulnerability allowed local     users to affect availability via vectors related to DML     (bsc#980904).

  - CVE-2016-0647: Unspecified vulnerability allowed local     users to affect availability via vectors related to FTS     (bsc#980904).

  - CVE-2016-0648: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#980904).

  - CVE-2016-0649: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#980904).

  - CVE-2016-0650: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Replication (bsc#980904).

  - CVE-2016-0651: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Optimizer (bsc#980904).

  - CVE-2016-0655: Unspecified vulnerability allowed local     users to affect availability via vectors related to     InnoDB (bsc#980904).

  - CVE-2016-0666: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Security: Privileges (bsc#980904).

  - CVE-2016-0668: Unspecified vulnerability allowed local     users to affect availability via vectors related to     InnoDB (bsc#980904).

  - CVE-2016-2047: The ssl_verify_server_cert function in     sql-common/client.c did not properly verify that the     server hostname matches a domain name in the subject's     Common Name (CN) or subjectAltName field of the X.509     certificate, which allowed man-in-the-middle attackers     to spoof SSL servers via a '/CN=' string in a field in a     certificate, as demonstrated by     '/OU=/CN=bar.com/CN=foo.com (bsc#963806).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

mariadb was updated to version 10.0.25 to fix 25 security issues.

These security issues were fixed :

  - CVE-2016-0505: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Options (bsc#980904).

  - CVE-2016-0546: Unspecified vulnerability allowed local     users to affect confidentiality, integrity, and     availability via unknown vectors related to Client     (bsc#980904).

  - CVE-2016-0596: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0597: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Optimizer (bsc#980904).

  - CVE-2016-0598: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0600: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to InnoDB (bsc#980904).

  - CVE-2016-0606: Unspecified vulnerability allowed remote     authenticated users to affect integrity via unknown     vectors related to encryption (bsc#980904).

  - CVE-2016-0608: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to UDF (bsc#980904).

  - CVE-2016-0609: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to privileges (bsc#980904).

  - CVE-2016-0616: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Optimizer (bsc#980904).

  - CVE-2016-0640: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0641: Unspecified vulnerability allowed local     users to affect confidentiality and availability via     vectors related to MyISAM (bsc#980904).

  - CVE-2016-0642: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to Federated (bsc#980904).

  - CVE-2016-0643: Unspecified vulnerability allowed local     users to affect confidentiality via vectors related to     DML (bsc#980904).

  - CVE-2016-0644: Unspecified vulnerability allowed local     users to affect availability via vectors related to DDL     (bsc#980904).

  - CVE-2016-0646: Unspecified vulnerability allowed local     users to affect availability via vectors related to DML     (bsc#980904).

  - CVE-2016-0647: Unspecified vulnerability allowed local     users to affect availability via vectors related to FTS     (bsc#980904).

  - CVE-2016-0648: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#980904).

  - CVE-2016-0649: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#980904).

  - CVE-2016-0650: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Replication (bsc#980904).

  - CVE-2016-0651: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Optimizer (bsc#980904).

  - CVE-2016-0655: Unspecified vulnerability allowed local     users to affect availability via vectors related to     InnoDB (bsc#980904).

  - CVE-2016-0666: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Security: Privileges (bsc#980904).

  - CVE-2016-0668: Unspecified vulnerability allowed local     users to affect availability via vectors related to     InnoDB (bsc#980904).

  - CVE-2016-2047: The ssl_verify_server_cert function in     sql-common/client.c did not properly verify that the     server hostname matches a domain name in the subject's     Common Name (CN) or subjectAltName field of the X.509     certificate, which allowed man-in-the-middle attackers     to spoof SSL servers via a '/CN=' string in a field in a     certificate, as demonstrated by     '/OU=/CN=bar.com/CN=foo.com (bsc#963806).

These non-security issues were fixed :

  - bsc#961935: Remove the leftovers of 'openSUSE' string in     the '-DWITH_COMMENT' and 'DCOMPILATION_COMMENT' options

  - bsc#970287: remove ha_tokudb.so plugin and     tokuft_logprint and tokuftdump binaries as TokuDB     storage engine requires the jemalloc library that isn't     present in SLE-12-SP1 

  - bsc#970295: Fix the leftovers of 'logrotate.d/mysql'     string in the logrotate error message. Occurrences of     this string were changed to 'logrotate.d/mariadb' 

  - bsc#963810: Add 'log-error' and 'secure-file-priv'     configuration options

  - add '/etc/my.cnf.d/error_log.conf' that specifies     'log-error = /var/log/mysql/mysqld.log'. If no path is     set, the error log is written to     '/var/lib/mysql/$HOSTNAME.err', which is not picked up     by logrotate.

  - add '/etc/my.cnf.d/secure_file_priv.conf' which     specifies that 'LOAD DATA', 'SELECT ... INTO' and 'LOAD     FILE()' will only work with files in the directory     specified by 'secure-file-priv' option     (='/var/lib/mysql-files').

mariadb was updated to version 10.0.25 to fix 25 security issues.

These security issues were fixed :

  - CVE-2016-0505: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Options (bsc#980904).

  - CVE-2016-0546: Unspecified vulnerability allowed local     users to affect confidentiality, integrity, and     availability via unknown vectors related to Client     (bsc#980904).

  - CVE-2016-0596: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0597: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Optimizer (bsc#980904).

  - CVE-2016-0598: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0600: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to InnoDB (bsc#980904).

  - CVE-2016-0606: Unspecified vulnerability allowed remote     authenticated users to affect integrity via unknown     vectors related to encryption (bsc#980904).

  - CVE-2016-0608: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to UDF (bsc#980904).

  - CVE-2016-0609: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to privileges (bsc#980904).

  - CVE-2016-0616: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Optimizer (bsc#980904).

  - CVE-2016-0640: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0641: Unspecified vulnerability allowed local     users to affect confidentiality and availability via     vectors related to MyISAM (bsc#980904).

  - CVE-2016-0642: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to Federated (bsc#980904).

  - CVE-2016-0643: Unspecified vulnerability allowed local     users to affect confidentiality via vectors related to     DML (bsc#980904).

  - CVE-2016-0644: Unspecified vulnerability allowed local     users to affect availability via vectors related to DDL     (bsc#980904).

  - CVE-2016-0646: Unspecified vulnerability allowed local     users to affect availability via vectors related to DML     (bsc#980904).

  - CVE-2016-0647: Unspecified vulnerability allowed local     users to affect availability via vectors related to FTS     (bsc#980904).

  - CVE-2016-0648: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#980904).

  - CVE-2016-0649: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#980904).

  - CVE-2016-0650: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Replication (bsc#980904).

  - CVE-2016-0651: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Optimizer (bsc#980904).

  - CVE-2016-0655: Unspecified vulnerability allowed local     users to affect availability via vectors related to     InnoDB (bsc#980904).

  - CVE-2016-0666: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Security: Privileges (bsc#980904).

  - CVE-2016-0668: Unspecified vulnerability allowed local     users to affect availability via vectors related to     InnoDB (bsc#980904).

  - CVE-2016-2047: The ssl_verify_server_cert function in     sql-common/client.c did not properly verify that the     server hostname matches a domain name in the subject's     Common Name (CN) or subjectAltName field of the X.509     certificate, which allowed man-in-the-middle attackers     to spoof SSL servers via a '/CN=' string in a field in a     certificate, as demonstrated by     '/OU=/CN=bar.com/CN=foo.com (bsc#963806).

These non-security issues were fixed :

  - bsc#970295: Fix the leftovers of 'logrotate.d/mysql'     string in the logrotate error message. Occurrences of     this string were changed to 'logrotate.d/mariadb'

  - bsc#963810: Add 'log-error' and 'secure-file-priv'     configuration options

  - add '/etc/my.cnf.d/error_log.conf' that specifies     'log-error = /var/log/mysql/mysqld.log'. If no path is     set, the error log is written to     '/var/lib/mysql/$HOSTNAME.err', which is not picked up     by logrotate.

  - add '/etc/my.cnf.d/secure_file_priv.conf' which     specifies that 'LOAD DATA', 'SELECT ... INTO' and 'LOAD     FILE()' will only work with files in the directory     specified by 'secure-file-priv' option     (='/var/lib/mysql-files').

  - Temporarily disable OQGraph. It seems to need the boost     library with the version not earlier than 1.40 and not     later than 1.55 (MDEV-9479)

  - boo#979524: Don't remove HandlerSocket plugin 

  - boo#970287: Add 'BuildRequires: jemalloc-devel' in order     to allow enabling of the TokuDB plugin 

  - run 'usermod -g mysql mysql' only if mysql user is not     in mysql group. Run 'usermod -s /bin/false/ mysql' only     if mysql user doesn't have '/bin/false' shell set.

  - Re-enable profiling support

Several issues have been discovered in the MariaDB database server.
The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.25. Please see the MariaDB 10.0 Release Notes for further details :

  -     https://mariadb.com/kb/en/mariadb/mariadb-10024-release-     notes/
  -     https://mariadb.com/kb/en/mariadb/mariadb-10025-release-     notes/

This mysql-community-server version update to 5.6.30 fixes the following issues :

Security issues fixed :

  - fixed CVEs (boo#962779, boo#959724): CVE-2016-0705,     CVE-2016-0639, CVE-2015-3194, CVE-2016-0640,     CVE-2016-2047, CVE-2016-0644, CVE-2016-0646,     CVE-2016-0647, CVE-2016-0648, CVE-2016-0649,     CVE-2016-0650, CVE-2016-0665, CVE-2016-0666,     CVE-2016-0641, CVE-2016-0642, CVE-2016-0655,     CVE-2016-0661, CVE-2016-0668, CVE-2016-0643

  - changes     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     30.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     29.html

Bugs fixed :

  - don't delete the log data when migration fails

  - add 'log-error' and 'secure-file-priv' configuration     options (added via configuration-tweaks.tar.bz2)     [boo#963810]

  - add '/etc/my.cnf.d/error_log.conf' that specifies     'log-error = /var/log/mysql/mysqld.log'. If no path is     set, the error log is written to     '/var/lib/mysql/$HOSTNAME.err', which is not picked up     by logrotate.

  - add '/etc/my.cnf.d/secure_file_priv.conf' which     specifies that 'LOAD DATA', 'SELECT ... INTO' and 'LOAD     FILE()' will only work with files in the directory     specified by 'secure-file-priv' option     (='/var/lib/mysql-files').

Oracle reports reports :

Critical Patch Update contains 31 new security fixes for Oracle MySQL 5.5.48, 5.6.29, 5.7.11 and earlier

The version of Oracle MySQL installed on the remote host is 5.7.x prior to 5.7.11. It is, therefore, affected by the following vulnerabilities :

  - A NULL pointer dereference flaw exists in the bundled     version of OpenSSL in file rsa_ameth.c due to improper     handling of ASN.1 signatures that are missing the PSS     parameter. A remote attacker can exploit this to cause     the signature verification routine to crash, resulting     in a denial of service condition. (CVE-2015-3194)

  - A flaw exists in the ASN1_TFLG_COMBINE implementation in     file tasn_dec.c related to handling malformed     X509_ATTRIBUTE structures. A remote attacker can exploit     this to cause a memory leak by triggering a decoding     failure in a PKCS#7 or CMS application, resulting in a     denial of service. (CVE-2015-3195)

  - An unspecified flaw exists in the DML subcomponent that     allows a local attacker to impact integrity and     availability. (CVE-2016-0640)

  - An unspecified flaw exists in the MyISAM subcomponent     that allows a local attacker to disclose potentially     sensitive information or cause a denial of service     condition. (CVE-2016-0641)

  - An unspecified flaw exists in the DDL subcomponent that     allows a local attacker to cause a denial of service     condition. (CVE-2016-0644)

  - Multiple unspecified flaws exist in the DML subcomponent     that allow a local attacker to cause a denial of     service condition. (CVE-2016-0646, CVE-2016-0652)

  - An unspecified flaw exists in the PS subcomponent that     allows a local attacker to cause a denial of service     condition. (CVE-2016-0649)

  - An unspecified flaw exists in the Replication     subcomponent that allows a local attacker to cause a     denial of service condition. (CVE-2016-0650)

  - An unspecified flaw exists in the FTS subcomponent that     allows a local attacker to cause a denial of service     condition. (CVE-2016-0653)

  - Multiple unspecified flaws exist in the InnoDB     subcomponent that allow a local attacker to cause a     denial of service condition. (CVE-2016-0654,     CVE-2016-0656, CVE-2016-0668)

  - An unspecified flaw exists in the Optimizer subcomponent     that allows a local attacker to cause a denial of     service condition. (CVE-2016-0658)

  - An unspecified flaw exists in the Options subcomponent     that allows a local attacker to cause a denial of     service condition. (CVE-2016-0661)

  - An unspecified flaw exists in the Performance Schema     subcomponent that allows a local attacker to cause a     denial of service condition. (CVE-2016-0663)

  - An unspecified flaw exists in the Security: Encryption     subcomponent that allows a local attacker to cause a     denial of service condition. (CVE-2016-0665)

  - An unspecified flaw exists in the Security: Encryption     subcomponent that allows an unauthenticated, remote     attacker to disclose potentially sensitive information.
    (CVE-2016-3452)

  - A denial of service vulnerability exists in the bundled     OpenSSL library due to improper handling of variables     declared as TEXT or BLOB. An authenticated, remote     attacker can exploit this to corrupt data or cause a     denial of service condition.

  - A denial of service vulnerability exists that is     triggered when handling a 'CREATE TEMPORARY TABLE ..
    SELECT' statement involving BIT columns. An     authenticated, remote attacker can exploit this to     create an improper table or cause the server to exit,     resulting in a denial of service condition.

  - A denial of service vulnerability exists due to improper     handling of queries that contain 'WHERE 0'. An     authenticated, remote attacker can exploit this to cause     an uninitialized read, resulting in a denial of service     condition.

The version of Oracle MySQL installed on the remote host is 5.6.x prior to 5.6.29. It is, therefore, affected by the following vulnerabilities :

  - A NULL pointer dereference flaw exists in the bundled     version of OpenSSL in file rsa_ameth.c due to improper     handling of ASN.1 signatures that are missing the PSS     parameter. A remote attacker can exploit this to cause     the signature verification routine to crash, resulting     in a denial of service condition. (CVE-2015-3194)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to impact     integrity and availability. (CVE-2016-0640)

  - An unspecified flaw exists in the MyISAM subcomponent     that allows an authenticated, remote attacker to     disclose sensitive information or cause a denial of     service condition. (CVE-2016-0641)

  - An unspecified flaw exists in the DDL subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0644)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0646)

  - An unspecified flaw exists in the PS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0649)

  - An unspecified flaw exists in the Replication     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-0650)

  - An unspecified flaw exists in the Options subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0661)

  - An unspecified flaw exists in the Security: Encryption     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-0665)

  - An unspecified flaw exists in the InnoDB subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0668)

  - A denial of service vulnerability exists in the bundled     OpenSSL library due to improper handling of variables     declared as TEXT or BLOB. An authenticated, remote     attacker can exploit this to corrupt data or cause a     denial of service condition.

  - A denial of service vulnerability exists that is     triggered when handling a 'CREATE TEMPORARY TABLE ..
    SELECT' statement involving BIT columns. An     authenticated, remote attacker can exploit this to     create an improper table or cause the server to exit,     resulting in a denial of service condition.

  - A denial of service vulnerability exists due to an     unspecified flaw in LOCK TABLES that is triggered when     opening a temporary MERGE table consisting of a view in     the list of tables. An authenticated, remote attacker     can exploit this to cause the server to exit, resulting     in a denial of service condition.

  - A denial of service vulnerability exists due to a flaw     that is triggered when repeatedly executing 'ALTER TABLE     v1 CHECK PARTITION' as a prepared statement. An     authenticated, remote attacker can exploit this to cause     the server to exit, resulting in a denial of service     condition.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2953-1 advisory.

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to     fix these issues.

    MySQL has been updated to 5.5.49 in Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Ubuntu 15.10 has been updated     to MySQL 5.6.30.

    In addition to security fixes, the updated packages contain bug fixes, new features, and possibly     incompatible changes.

    Please see the following for more information:
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-48.html     http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-49.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-29.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-30.html     http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL installed on the remote host is 5.5.x prior to 5.5.48, 5.6.x prior to 5.6.29, or 5.7.x prior to 5.7.11, and is affected by vulnerabilities in the following components :

 - Data Manipulation Language
 - Data Definition Language
 - Full-Text Search
 - MyISAM
 - PeopleSoft
 - Performance Schema
 - Pluggable Authentication
 - Replication
 - Server Connection
 - Server:Security
 - Server:InnoDB
 - Server:Optimizer
 - Server:Options


The version of MySQL running on the remote host is 5.6.x prior to 5.6.29. It is, therefore, affected by multiple vulnerabilities :
 - A NULL pointer dereference flaw exists in the bundled version of OpenSSL in file rsa_ameth.c due to improper handling of ASN.1 signatures that are missing the PSS parameter. A remote attacker can exploit this to cause the signature verification routine to crash, resulting in a denial of service condition. (CVE-2015-3194)
 - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to impact integrity and availability. (CVE-2016-0640)
 - An unspecified flaw exists in the MyISAM subcomponent that allows an authenticated, remote attacker to disclose sensitive information or cause a denial of service condition. (CVE-2016-0641)
 - An unspecified flaw exists in the DDL subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0644)
 - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0646)
 - An unspecified flaw exists in the PS subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0649)
 - An unspecified flaw exists in the Replication subcomponent that allows an authenticated, remote attacker to cause a denial of service condition.(CVE-2016-0650)
 - An unspecified flaw exists in the Options subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0661)
 - An unspecified flaw exists in the Security: Encryption subcomponent that allows an authenticated, remote attacker to cause a denial of service condition.(CVE-2016-0665)
 - An unspecified flaw exists in the InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0668)
 - A denial of service vulnerability exists in the bundled OpenSSL library due to improper handling of variables declared as TEXT or BLOB. An authenticated, remote attacker can exploit this to corrupt data or cause a denial of service condition.
 - A denial of service vulnerability exists that is triggered when handling a 'CREATE TEMPORARY TABLE ..SELECT' statement involving BIT columns. An authenticated, remote attacker can exploit this to create an improper table or cause the server to exit, resulting in a denial of service condition.
 - A denial of service vulnerability exists due to an unspecified flaw in LOCK TABLES that is triggered when opening a temporary MERGE table consisting of a view in the list of tables. An authenticated, remote attacker can exploit this to cause the server to exit, resulting in a denial of service condition.
 - A denial of service vulnerability exists due to a flaw that is triggered when repeatedly executing 'ALTER TABLE v1 CHECK PARTITION' as a prepared statement. An authenticated, remote attacker can exploit this to cause the server to exit, resulting in a denial of service condition.

The version of MySQL running on the remote host is 5.7.x prior to 5.7.11. It is, therefore, potentially affected by multiple vulnerabilities :

  - A NULL pointer dereference flaw exists in the bundled     version of OpenSSL in file rsa_ameth.c due to improper     handling of ASN.1 signatures that are missing the PSS     parameter. A remote attacker can exploit this to cause     the signature verification routine to crash, resulting     in a denial of service condition. (CVE-2015-3194)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to impact     integrity and availability. (CVE-2016-0640)

  - An unspecified flaw exists in the MyISAM subcomponent     that allows an authenticated, remote attacker to     disclose sensitive information or cause a denial of     service condition. (CVE-2016-0641)

  - An unspecified flaw exists in the DDL subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0644)

  - Multiple unspecified flaws exist in the DML subcomponent     that allow an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0646,     CVE-2016-0652)

  - An unspecified flaw exists in the PS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0649)

  - An unspecified flaw exists in the Replication     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-0650)

  - An unspecified flaw exists in the FTS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0653)

  - Multiple unspecified flaws exist in the InnoDB     subcomponent that allow an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-0654, CVE-2016-0656, CVE-2016-0668)

  - An unspecified flaw exists in the Optimizer subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0658)

  - An unspecified flaw exists in the Options subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0661)

  - An unspecified flaw exists in the Performance Schema     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-0663)

  - An unspecified flaw exists in the Security: Encryption     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-0665)

  - A denial of service vulnerability exists in the bundled     OpenSSL library due to improper handling of variables     declared as TEXT or BLOB. An authenticated, remote     attacker can exploit this to corrupt data or cause a     denial of service condition.

  - A denial of service vulnerability exists that is     triggered when handling a 'CREATE TEMPORARY TABLE ..
    SELECT' statement involving BIT columns. An     authenticated, remote attacker can exploit this to     create an improper table or cause the server to exit,     resulting in a denial of service condition.

  - A denial of service vulnerability exists due to improper     handling of queries that contain 'WHERE 0'. An     authenticated, remote attacker can exploit this to cause     an uninitialized read, resulting in a denial of service     condition.

The version of MySQL running on the remote host is 5.6.x prior to 5.6.29. It is, therefore, affected by multiple vulnerabilities :

  - A NULL pointer dereference flaw exists in the bundled     version of OpenSSL in file rsa_ameth.c due to improper     handling of ASN.1 signatures that are missing the PSS     parameter. A remote attacker can exploit this to cause     the signature verification routine to crash, resulting     in a denial of service condition. (CVE-2015-3194)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to impact     integrity and availability. (CVE-2016-0640)

  - An unspecified flaw exists in the MyISAM subcomponent     that allows an authenticated, remote attacker to     disclose sensitive information or cause a denial of     service condition. (CVE-2016-0641)

  - An unspecified flaw exists in the DDL subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0644)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0646)

  - An unspecified flaw exists in the PS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0649)

  - An unspecified flaw exists in the Replication     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-0650)

  - An unspecified flaw exists in the Options subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0661)

  - An unspecified flaw exists in the Security: Encryption     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-0665)

  - An unspecified flaw exists in the InnoDB subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0668)

  - A denial of service vulnerability exists in the bundled     OpenSSL library due to improper handling of variables     declared as TEXT or BLOB. An authenticated, remote     attacker can exploit this to corrupt data or cause a     denial of service condition.

  - A denial of service vulnerability exists that is     triggered when handling a 'CREATE TEMPORARY TABLE ..
    SELECT' statement involving BIT columns. An     authenticated, remote attacker can exploit this to     create an improper table or cause the server to exit,     resulting in a denial of service condition.

  - A denial of service vulnerability exists due to an     unspecified flaw in LOCK TABLES that is triggered when     opening a temporary MERGE table consisting of a view in     the list of tables. An authenticated, remote attacker     can exploit this to cause the server to exit, resulting     in a denial of service condition.

  - A denial of service vulnerability exists due to a flaw     that is triggered when repeatedly executing 'ALTER TABLE     v1 CHECK PARTITION' as a prepared statement. An     authenticated, remote attacker can exploit this to cause     the server to exit, resulting in a denial of service     condition.

ID	Name	Product	Family	Severity
193833	RHEL 6 / 7 : rh-mariadb100-mariadb (RHSA-2016:1132)	Nessus	Red Hat Local Security Checks	critical
93829	MariaDB 10.1.x < 10.1.12 Multiple Vulnerabilities	Nessus	Databases	medium
93828	MariaDB 10.0.x < 10.0.24 Multiple Vulnerabilities	Nessus	Databases	medium
93159	SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:1620-1)	Nessus	SuSE Local Security Checks	medium
93158	SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:1619-1)	Nessus	SuSE Local Security Checks	medium
91871	openSUSE Security Update : mariadb (openSUSE-2016-780)	Nessus	SuSE Local Security Checks	medium
91794	openSUSE Security Update : mariadb (openSUSE-2016-761)	Nessus	SuSE Local Security Checks	medium
91474	Debian DSA-3595-1 : mariadb-10.0 - security update	Nessus	Debian Local Security Checks	medium
91277	openSUSE Security Update : mysql-community-server (openSUSE-2016-607)	Nessus	SuSE Local Security Checks	critical
90847	FreeBSD : MySQL -- multiple vulnerabilities (8c2b2f11-0ebe-11e6-b55e-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	critical
90833	Oracle MySQL 5.7.x < 5.7.11 Multiple Vulnerabilities (April 2016 CPU) (July 2016 CPU)	Nessus	Databases	medium
90831	Oracle MySQL 5.6.x < 5.6.29 Multiple Vulnerabilities (April 2016 CPU)	Nessus	Databases	medium
90678	Ubuntu 14.04 LTS : MySQL vulnerabilities (USN-2953-1)	Nessus	Ubuntu Local Security Checks	critical
9259	Oracle MySQL 5.5.x < 5.5.48 / 5.6.x < 5.6.29 / 5.7.x < 5.7.11 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
9238	MySQL 5.6.x < 5.6.29 Multiple DoS	Nessus Network Monitor	Database	medium
89056	MySQL 5.7.x < 5.7.11 Multiple Vulnerabilities	Nessus	Databases	medium
89055	MySQL 5.6.x < 5.6.29 Multiple Vulnerabilities	Nessus	Databases	medium

Detections

Analytics

CVE-2016-0668

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

critical

critical

medium

medium

critical

medium

medium

medium

medium