Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-3600. Reason: This candidate is a reservation duplicate of CVE-2017-3600. Notes: All CVE users should reference CVE-2017-3600 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2787 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld,     and many client programs.

    The following packages have been upgraded to a later upstream version: rh-mysql56-mysql (5.6.37).

    Security Fix(es):

    * An integer overflow flaw leading to a buffer overflow was found in the way MySQL parsed connection     handshake packets. An unauthenticated remote attacker with access to the MySQL port could use this flaw to     crash the mysqld daemon. (CVE-2017-3599)

    * It was discovered that the mysql and mysqldump tools did not correctly handle database and table names     containing newline characters. A database user with privileges to create databases or tables could cause     the mysql command to execute arbitrary shell or SQL commands while restoring database backup created using     the mysqldump tool. (CVE-2016-5483, CVE-2017-3600)

    * Multiple flaws were found in the way the MySQL init script handled initialization of the database data     directory and permission setting on the error log file. The mysql operating system user could use these     flaws to escalate their privileges to root. (CVE-2017-3265)

    * It was discovered that the mysqld_safe script honored the ledir option value set in a MySQL     configuration file. A user able to modify one of the MySQL configuration files could use this flaw to     escalate their privileges to root. (CVE-2017-3291)

    * It was discovered that the MySQL client command line tools only checked after authentication whether     server supported SSL. A man-in-the-middle attacker could use this flaw to hijack client's authentication     to the server even if the client was configured to require SSL connection. (CVE-2017-3305)

    * Multiple flaws were found in the way the mysqld_safe script handled creation of error log file. The     mysql operating system user could use these flaws to escalate their privileges to root. (CVE-2017-3312)

    * A flaw was found in the way MySQL client library (libmysqlclient) handled prepared statements when     server connection was lost. A malicious server or a man-in-the-middle attacker could possibly use this     flaw to crash an application using libmysqlclient. (CVE-2017-3302)

    * This update fixes several vulnerabilities in the MySQL database server. Information about these flaws     can be found on the Oracle Critical Patch Update Advisory pages listed in the References section.
    (CVE-2016-8327, CVE-2017-3238, CVE-2017-3244, CVE-2017-3257, CVE-2017-3258, CVE-2017-3273, CVE-2017-3308,     CVE-2017-3309, CVE-2017-3313, CVE-2017-3317, CVE-2017-3318, CVE-2017-3450, CVE-2017-3452, CVE-2017-3453,     CVE-2017-3456, CVE-2017-3461, CVE-2017-3462, CVE-2017-3463, CVE-2017-3464, CVE-2017-3633, CVE-2017-3634,     CVE-2017-3636, CVE-2017-3641, CVE-2017-3647, CVE-2017-3648, CVE-2017-3649, CVE-2017-3651, CVE-2017-3652,     CVE-2017-3653)

    Red Hat would like to thank Pali Rohr for reporting CVE-2017-3305.

    Bug Fix(es):

    * Previously, the md5() function was blocked by MySQL in FIPS mode because the MD5 hash algorithm is     considered insecure. Consequently, the mysqld daemon failed with error messages when FIPS mode was     enabled. With this update, md5() is allowed in FIPS mode for non-security operations. Note that users are     able to use md5() for security purposes but such usage is not supported by Red Hat. (BZ#1452469)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2927 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is     binary-compatible with MySQL.

    The following packages have been upgraded to a newer upstream version: rh-mariadb100-mariadb (10.0.28).

    Security Fix(es):

    * It was discovered that the MariaDB logging functionality allowed writing to MariaDB configuration files.
    An administrative database user, or a database user with FILE privileges, could possibly use this flaw to     run arbitrary commands with root privileges on the system running the database server. (CVE-2016-6662)

    * A race condition was found in the way MariaDB performed MyISAM engine table repair. A database user with     shell access to the server running mysqld could use this flaw to change permissions of arbitrary files     writable by the mysql system user. (CVE-2016-6663, CVE-2016-5616)

    * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws     can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
    (CVE-2016-3492, CVE-2016-5612, CVE-2016-5624, CVE-2016-5626, CVE-2016-5629, CVE-2016-5630, CVE-2016-8283)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mysql: Server: Partition unspecified vulnerability (CPU Jan 2018) (CVE-2018-2562)

  - mysql: Server: Replication unspecified vulnerability (CPU Apr 2018) (CVE-2018-2755)

  - Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and     MariaDB 5.1.x through 5.1.62, 5.2.x through 5.2.12, 5.3.x through 5.3.7, and 5.5.x through 5.5.25, allow     remote authenticated users to execute arbitrary SQL commands via vectors related to the binary log. NOTE:
    as of 20130116, Oracle has not commented on claims from a downstream vendor that the fix in MySQL 5.5.29     is incomplete. (CVE-2012-4414)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mysql: Server: Partition unspecified vulnerability (CPU Jan 2018) (CVE-2018-2562)

  - mysql: Server: Replication unspecified vulnerability (CPU Apr 2018) (CVE-2018-2755)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and     earlier, allows local users to affect confidentiality via unknown vectors related to Server Installation.
    (CVE-2012-3160)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2886 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld,     and many client programs.

    The following packages have been upgraded to a later upstream version: rh-mysql57-mysql (5.7.19).

    Security Fix(es):

    * An integer overflow flaw leading to a buffer overflow was found in the way MySQL parsed connection     handshake packets. An unauthenticated remote attacker with access to the MySQL port could use this flaw to     crash the mysqld daemon. (CVE-2017-3599)

    * It was discovered that the mysql and mysqldump tools did not correctly handle database and table names     containing newline characters. A database user with privileges to create databases or tables could cause     the mysql command to execute arbitrary shell or SQL commands while restoring database backup created using     the mysqldump tool. (CVE-2016-5483, CVE-2017-3600)

    * It was discovered that the mysqld_safe script honored the ledir option value set in a MySQL     configuration file. A user able to modify one of the MySQL configuration files could use this flaw to     escalate their privileges to root. (CVE-2017-3291)

    * Multiple flaws were found in the way the mysqld_safe script handled creation of error log file. The     mysql operating system user could use these flaws to escalate their privileges to root. (CVE-2017-3312)

    * This update fixes several vulnerabilities in the MySQL database server. Information about these flaws     can be found on the Oracle Critical Patch Update Advisory pages listed in the References section.
    (CVE-2016-8327, CVE-2017-3238, CVE-2017-3244, CVE-2017-3251, CVE-2017-3256, CVE-2017-3257, CVE-2017-3258,     CVE-2017-3273, CVE-2017-3308, CVE-2017-3309, CVE-2017-3313, CVE-2017-3317, CVE-2017-3318, CVE-2017-3319,     CVE-2017-3320, CVE-2017-3331, CVE-2017-3450, CVE-2017-3453, CVE-2017-3454, CVE-2017-3455, CVE-2017-3456,     CVE-2017-3457, CVE-2017-3458, CVE-2017-3459, CVE-2017-3460, CVE-2017-3461, CVE-2017-3462, CVE-2017-3463,     CVE-2017-3464, CVE-2017-3465, CVE-2017-3467, CVE-2017-3468, CVE-2017-3529, CVE-2017-3633, CVE-2017-3634,     CVE-2017-3637, CVE-2017-3638, CVE-2017-3639, CVE-2017-3640, CVE-2017-3641, CVE-2017-3642, CVE-2017-3643,     CVE-2017-3644, CVE-2017-3645, CVE-2017-3646, CVE-2017-3647, CVE-2017-3648, CVE-2017-3649, CVE-2017-3650,     CVE-2017-3651, CVE-2017-3652, CVE-2017-3653)

    Bug Fix(es):

    * Prior to this update, the scl macros were not set for the rh-mysql57-mysqld@.service file, which     consequently made the service file unusable. This bug has been fixed, and rh-mysql57-mysqld@.service now     works as expected. (BZ#1452511)

    * Previously, the md5() function was blocked by MySQL in FIPS mode because the MD5 hash algorithm is     considered insecure. Consequently, the mysqld daemon failed with error messages when FIPS mode was     enabled. With this update, md5() is allowed in FIPS mode for non-security operations. Note that users are     able to use md5() for security purposes but such usage is not supported by Red Hat. (BZ#1452514)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 5.5.53. It is, therefore, affected by multiple vulnerabilities as referenced in the mariadb-5-5-53-release-notes advisory.

  - Unspecified vulnerability in Oracle MySQL 5.5.52 and earlier, 5.6.33 and earlier, and 5.7.15 and earlier     allows remote administrators to affect confidentiality via vectors related to Server: Security:
    Encryption. (CVE-2016-5584)

  - The C software implementation of AES Encryption and Decryption in wolfSSL (formerly CyaSSL) before 3.9.10     makes it easier for local users to discover AES keys by leveraging cache-bank timing differences.
    (CVE-2016-7440)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump). Supported     versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Difficult to     exploit vulnerability allows high privileged attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server.
    Note: CVE-2017-3600 is equivalent to CVE-2016-5483. (CVE-2017-3600)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump). Supported     versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Easily     exploitable vulnerability allows low privileged attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of MySQL Server accessible data. (CVE-2017-3651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the mariadb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the mysql and mysqldump tools     did not correctly handle database and table names     containing newline characters. A database user with     privileges to create databases or tables could cause     the mysql command to execute arbitrary shell or SQL     commands while restoring database backup created using     the mysqldump tool. (CVE-2016-5483, CVE-2017-3600)

  - A flaw was found in the way the mysqld_safe script     handled creation of error log file. The mysql operating     system user could use this flaw to escalate their     privileges to root. (CVE-2016-5617, CVE-2016-6664)

  - Multiple flaws were found in the way the MySQL init     script handled initialization of the database data     directory and permission setting on the error log file.
    The mysql operating system user could use these flaws     to escalate their privileges to root. (CVE-2017-3265)

  - It was discovered that the mysqld_safe script honored     the ledir option value set in a MySQL configuration     file. A user able to modify one of the MySQL     configuration files could use this flaw to escalate     their privileges to root. (CVE-2017-3291)

  - Multiple flaws were found in the way the mysqld_safe     script handled creation of error log file. The mysql     operating system user could use these flaws to escalate     their privileges to root. (CVE-2017-3312)

  - A flaw was found in the way MySQL client library     (libmysqlclient) handled prepared statements when     server connection was lost. A malicious server or a     man-in-the-middle attacker could possibly use this flaw     to crash an application using libmysqlclient.
    (CVE-2017-3302)

  - This update fixes several vulnerabilities in the     MariaDB database server. Information about these flaws     can be found on the Oracle Critical Patch Update     Advisory page, listed in the References section.
    (CVE-2017-3238, CVE-2017-3243, CVE-2017-3244,     CVE-2017-3258, CVE-2017-3308, CVE-2017-3309,     CVE-2017-3313, CVE-2017-3317, CVE-2017-3318,     CVE-2017-3453, CVE-2017-3456, CVE-2017-3464)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for mariadb is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version:
mariadb (5.5.56). (BZ#1458933)

Security Fix(es) :

* It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or tables could cause the mysql command to execute arbitrary shell or SQL commands while restoring database backup created using the mysqldump tool. (CVE-2016-5483, CVE-2017-3600)

* A flaw was found in the way the mysqld_safe script handled creation of error log file. The mysql operating system user could use this flaw to escalate their privileges to root. (CVE-2016-5617, CVE-2016-6664)

* Multiple flaws were found in the way the MySQL init script handled initialization of the database data directory and permission setting on the error log file. The mysql operating system user could use these flaws to escalate their privileges to root. (CVE-2017-3265)

* It was discovered that the mysqld_safe script honored the ledir option value set in a MySQL configuration file. A user able to modify one of the MySQL configuration files could use this flaw to escalate their privileges to root. (CVE-2017-3291)

* Multiple flaws were found in the way the mysqld_safe script handled creation of error log file. The mysql operating system user could use these flaws to escalate their privileges to root. (CVE-2017-3312)

* A flaw was found in the way MySQL client library (libmysqlclient) handled prepared statements when server connection was lost. A malicious server or a man-in-the-middle attacker could possibly use this flaw to crash an application using libmysqlclient.
(CVE-2017-3302)

* This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
(CVE-2017-3238, CVE-2017-3243, CVE-2017-3244, CVE-2017-3258, CVE-2017-3308, CVE-2017-3309, CVE-2017-3313, CVE-2017-3317, CVE-2017-3318, CVE-2017-3453, CVE-2017-3456, CVE-2017-3464)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The following packages have been upgraded to a later upstream version:
mariadb (5.5.56).

Security Fix(es) :

  - It was discovered that the mysql and mysqldump tools did     not correctly handle database and table names containing     newline characters. A database user with privileges to     create databases or tables could cause the mysql command     to execute arbitrary shell or SQL commands while     restoring database backup created using the mysqldump     tool. (CVE-2016-5483, CVE-2017-3600)

  - A flaw was found in the way the mysqld_safe script     handled creation of error log file. The mysql operating     system user could use this flaw to escalate their     privileges to root. (CVE-2016-5617, CVE-2016-6664)

  - Multiple flaws were found in the way the MySQL init     script handled initialization of the database data     directory and permission setting on the error log file.
    The mysql operating system user could use these flaws to     escalate their privileges to root. (CVE-2017-3265)

  - It was discovered that the mysqld_safe script honored     the ledir option value set in a MySQL configuration     file. A user able to modify one of the MySQL     configuration files could use this flaw to escalate     their privileges to root. (CVE-2017-3291)

  - Multiple flaws were found in the way the mysqld_safe     script handled creation of error log file. The mysql     operating system user could use these flaws to escalate     their privileges to root. (CVE-2017-3312)

  - A flaw was found in the way MySQL client library     (libmysqlclient) handled prepared statements when server     connection was lost. A malicious server or a     man-in-the-middle attacker could possibly use this flaw     to crash an application using libmysqlclient.
    (CVE-2017-3302)

(CVE-2017-3238, CVE-2017-3243, CVE-2017-3244, CVE-2017-3258, CVE-2017-3308, CVE-2017-3309, CVE-2017-3313, CVE-2017-3317, CVE-2017-3318, CVE-2017-3453, CVE-2017-3456, CVE-2017-3464)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2192 advisory.

    - Rebase to 5.5.56       That release also fixes the following security issues:
      CVE-2016-5617/CVE-2016-6664 CVE-2017-3312 CVE-2017-3238 CVE-2017-3243       CVE-2017-3244 CVE-2017-3258 CVE-2017-3313 CVE-2017-3317 CVE-2017-3318       CVE-2017-3291 CVE-2017-3302 CVE-2016-5483/CVE-2017-3600 CVE-2017-3308       CVE-2017-3309 CVE-2017-3453 CVE-2017-3456 CVE-2017-3464       Resolves: #1458933       New deps required by upstream: checkpolicy and policycoreutils-python       License text removed by upstream: COPYING.LESSER       Do not ignore test-suite failure       Downstream script mariadb-prepare-db-dir fixed for CVE-2017-3265       Resolves: #1458940

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2192 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    The following packages have been upgraded to a later upstream version: mariadb (5.5.56). (BZ#1458933)

    Security Fix(es):

    * It was discovered that the mysql and mysqldump tools did not correctly handle database and table names     containing newline characters. A database user with privileges to create databases or tables could cause     the mysql command to execute arbitrary shell or SQL commands while restoring database backup created using     the mysqldump tool. (CVE-2016-5483, CVE-2017-3600)

    * A flaw was found in the way the mysqld_safe script handled creation of error log file. The mysql     operating system user could use this flaw to escalate their privileges to root. (CVE-2016-5617,     CVE-2016-6664)

    * Multiple flaws were found in the way the MySQL init script handled initialization of the database data     directory and permission setting on the error log file. The mysql operating system user could use these     flaws to escalate their privileges to root. (CVE-2017-3265)

    * It was discovered that the mysqld_safe script honored the ledir option value set in a MySQL     configuration file. A user able to modify one of the MySQL configuration files could use this flaw to     escalate their privileges to root. (CVE-2017-3291)

    * Multiple flaws were found in the way the mysqld_safe script handled creation of error log file. The     mysql operating system user could use these flaws to escalate their privileges to root. (CVE-2017-3312)

    * A flaw was found in the way MySQL client library (libmysqlclient) handled prepared statements when     server connection was lost. A malicious server or a man-in-the-middle attacker could possibly use this     flaw to crash an application using libmysqlclient. (CVE-2017-3302)

    * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws     can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
    (CVE-2017-3238, CVE-2017-3243, CVE-2017-3244, CVE-2017-3258, CVE-2017-3308, CVE-2017-3309, CVE-2017-3313,     CVE-2017-3317, CVE-2017-3318, CVE-2017-3453, CVE-2017-3456, CVE-2017-3464)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for mysql-community-server to version 5.6.36 fixes the following issues :

These security issues were fixed :

  - CVE-2016-5483: Mysqldump failed to properly quote     certain identifiers in SQL statements written to the     dump output, allowing for execution of arbitrary     commands (bsc#1029014)

  - CVE-2017-3305: MySQL client sent authentication request     unencrypted even if SSL was required (aka Ridddle)     (bsc#1029396).

  - CVE-2017-3308: Unspecified vulnerability in Server: DML     (boo#1034850)

  - CVE-2017-3309: Unspecified vulnerability in Server:
    Optimizer (boo#1034850)

  - CVE-2017-3329: Unspecified vulnerability in Server:
    Thread (boo#1034850)

  - CVE-2017-3453: Unspecified vulnerability in Server:
    Optimizer (boo#1034850)

  - CVE-2017-3456: Unspecified vulnerability in Server: DML     (boo#1034850)

  - CVE-2017-3461: Unspecified vulnerability in Server:
    Security (boo#1034850)

  - CVE-2017-3462: Unspecified vulnerability in Server:
    Security (boo#1034850)

  - CVE-2017-3463: Unspecified vulnerability in Server:
    Security (boo#1034850)

  - CVE-2017-3464: Unspecified vulnerability in Server: DDL     (boo#1034850)

  - CVE-2017-3302: Crash in libmysqlclient.so (bsc#1022428).

  - CVE-2017-3450: Unspecified vulnerability Server:
    Memcached

  - CVE-2017-3452: Unspecified vulnerability Server:
    Optimizer

  - CVE-2017-3599: Unspecified vulnerability Server:
    Pluggable Auth

  - CVE-2017-3600: Unspecified vulnerability in Client:
    mysqldump (boo#1034850)

  - '--ssl-mode=REQUIRED' can be specified to require a     secure connection (it fails if a secure connection     cannot be obtained)

These non-security issues were fixed :

  - Set the default umask to 077 in mysql-systemd-helper     (boo#1020976)

  - Change permissions of the configuration dir/files to     755/644. Please note that storing the password in the     /etc/my.cnf file is not safe. Use for example an option     file that is accessible only by yourself (boo#889126)

For more information please see http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-36.html

This update for mysql to version 5.5.55 fixes the following issues:
These security issues were fixed :

  - CVE-2017-3308: Unspecified vulnerability in Server: DML     (bsc#1034850)

  - CVE-2017-3309: Unspecified vulnerability in Server:
    Optimizer (bsc#1034850)

  - CVE-2017-3329: Unspecified vulnerability in Server:
    Thread (bsc#1034850)

  - CVE-2017-3600: Unspecified vulnerability in Client:
    mysqldump (bsc#1034850)

  - CVE-2017-3453: Unspecified vulnerability in Server:
    Optimizer (bsc#1034850)

  - CVE-2017-3456: Unspecified vulnerability in Server: DML     (bsc#1034850)

  - CVE-2017-3463: Unspecified vulnerability in Server:
    Security (bsc#1034850)

  - CVE-2017-3462: Unspecified vulnerability in Server:
    Security (bsc#1034850)

  - CVE-2017-3461: Unspecified vulnerability in Server:
    Security (bsc#1034850)

  - CVE-2017-3464: Unspecified vulnerability in Server: DDL     (bsc#1034850)

  - CVE-2017-3305: MySQL client sent authentication request     unencrypted even if SSL was required (aka Ridddle)     (bsc#1029396).

  - CVE-2016-5483: Mysqldump failed to properly quote     certain identifiers in SQL statements written to the     dump output, allowing for execution of arbitrary     commands (bsc#1029014)

  - '--ssl-mode=REQUIRED' can be specified to require a     secure connection (it fails if a secure connection     cannot be obtained)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.55, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details :

https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-55.html http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618 .html

For Debian 7 'Wheezy', these problems have been fixed in version 5.5.55-0+deb7u1.

We recommend that you upgrade your mysql-5.5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MariaDB running on the remote host is 10.1.x prior to 10.1.19. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the Security: Encryption     subcomponent that allows an authenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-5584)

  - A flaw exists in wolfSSL, specifically within the C     software version of AES Encryption and Decryption, due     to table lookups not properly considering cache-bank     access times. A local attacker can exploit this, via a     specially crafted application, to disclose AES keys.
    Note that this vulnerability does not affect MariaDB     packages included in Red Hat products since they're     built against system OpenSSL packages. (CVE-2016-7440)

  - A flaw exists in the fill_alter_inplace_info() function     in sql_table.cc that is triggered when altering     persistent virtual columns. An authenticated, remote     attacker can exploit this to crash the database,     resulting in a denial of service condition.

  - A flaw exists in the mysql_rm_table_no_locks() function     in sql_table.cc that is triggered during the handling of     CREATE OR REPLACE TABLE queries. An authenticated,     remote attacker can exploit this to crash the database,     resulting in a denial of service condition.

  - A flaw exists in the buf_page_is_checksum_valid*     functions in buf0buf.cc that is triggered during the     handling of encrypted information. An authenticated,     remote attacker can exploit this to crash the database,     resulting in a denial of service condition.

  - A flaw exists in the wsrep_replicate_myisam     functionality that is triggered when dropping MyISAM     tables. An authenticated, remote attacker can exploit     this to crash the database, resulting in a denial of     service condition.

The version of MariaDB running on the remote host is 10.0.x prior to 10.0.28. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the Optimizer subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-3492)

  - An unspecified flaw exists in the Security: Encryption     subcomponent that allows an authenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-5584)

  - An unspecified flaw exists in the MyISAM subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-5616)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5624)

  - An unspecified flaw exists in the GIS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5626)

  - An unspecified flaw exists in the Federated subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5629)

  - An unspecified flaw exists that allows an authenticated,     remote attacker to bypass restrictions and create the     /var/lib/mysql/my.cnf file with custom contents without     the FILE privilege requirement. (CVE-2016-6663)

  - A flaw exists in wolfSSL, specifically within the C     software version of AES Encryption and Decryption, due     to table lookups not properly considering cache-bank     access times. A local attacker can exploit this, via a     specially crafted application, to disclose AES keys.
    Note that this vulnerability does not affect MariaDB     packages included in Red Hat products since they're     built against system OpenSSL packages. (CVE-2016-7440)

  - An unspecified flaw exists in the Types subcomponent     that allows an authenticated, remote attacker to cause     a denial of service condition. (CVE-2016-8283)

  - A flaw exists in the fix_after_pullout() function in     item.cc that is triggered when handling a prepared     statement with a conversion to semi-join. An     authenticated, remote attacker can exploit this to crash     the database, resulting in a denial of service     condition.

  - A flaw exists in the mysql_admin_table() function in     sql_admin.cc that is triggered when handling     re-execution of certain ANALYZE TABLE prepared     statements. An authenticated, remote attacker can     exploit this to crash the database, resulting in a     denial of service condition.

  - A flaw exists in the fill_alter_inplace_info() function     in sql_table.cc that is triggered when altering     persistent virtual columns. An authenticated, remote     attacker can exploit this to crash the database,     resulting in a denial of service condition.

  - A flaw exists in the mysql_rm_table_no_locks() function     in sql_table.cc that is triggered during the handling of     CREATE OR REPLACE TABLE queries. An authenticated,     remote attacker can exploit this to crash the database,     resulting in a denial of service condition.

ID	Name	Product	Family	Severity
210269	RHEL 6 / 7 : rh-mysql56-mysql (RHSA-2017:2787)	Nessus	Red Hat Local Security Checks	medium
210177	RHEL 6 / 7 : rh-mariadb100-mariadb (RHSA-2016:2927)	Nessus	Red Hat Local Security Checks	critical
198654	RHEL 6 : mysql (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198625	RHEL 5 : mysql (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196462	RHEL 5 : mariadb,_mysql (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
196381	RHEL 6 : mariadb,_mysql (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
194054	RHEL 6 / 7 : rh-mysql57-mysql (RHSA-2017:2886)	Nessus	Red Hat Local Security Checks	medium
167886	MariaDB 5.5.0 < 5.5.53 Multiple Vulnerabilities	Nessus	Databases	medium
103008	EulerOS 2.0 SP2 : mariadb (EulerOS-SA-2017-1170)	Nessus	Huawei Local Security Checks	high
103007	EulerOS 2.0 SP1 : mariadb (EulerOS-SA-2017-1169)	Nessus	Huawei Local Security Checks	high
102755	CentOS 7 : mariadb (CESA-2017:2192)	Nessus	CentOS Local Security Checks	high
102648	Scientific Linux Security Update : mariadb on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	high
102299	Oracle Linux 7 : mariadb (ELSA-2017-2192)	Nessus	Oracle Linux Local Security Checks	high
102152	RHEL 7 : mariadb (RHSA-2017:2192)	Nessus	Red Hat Local Security Checks	high
100039	openSUSE Security Update : mysql-community-server (openSUSE-2017-555) (Riddle)	Nessus	SuSE Local Security Checks	high
99760	SUSE SLES11 Security Update : mysql (SUSE-SU-2017:1137-1) (Riddle)	Nessus	SuSE Local Security Checks	high
99673	Debian DLA-916-1 : mysql-5.5 security update (Riddle)	Nessus	Debian Local Security Checks	high
95541	MariaDB 10.1.x < 10.1.19 Multiple Vulnerabilities	Nessus	Databases	medium
95540	MariaDB 10.0.x < 10.0.28 Multiple Vulnerabilities	Nessus	Databases	high

Detections

Analytics

CVE-2016-5483

No Score

Tenable Plugins

medium

critical

high

high

medium

medium

medium

medium

high

high

high

high

high

high

high

high

high

medium

high