Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2927 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is     binary-compatible with MySQL.

    The following packages have been upgraded to a newer upstream version: rh-mariadb100-mariadb (10.0.28).

    Security Fix(es):

    * It was discovered that the MariaDB logging functionality allowed writing to MariaDB configuration files.
    An administrative database user, or a database user with FILE privileges, could possibly use this flaw to     run arbitrary commands with root privileges on the system running the database server. (CVE-2016-6662)

    * A race condition was found in the way MariaDB performed MyISAM engine table repair. A database user with     shell access to the server running mysqld could use this flaw to change permissions of arbitrary files     writable by the mysql system user. (CVE-2016-6663, CVE-2016-5616)

    * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws     can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
    (CVE-2016-3492, CVE-2016-5612, CVE-2016-5624, CVE-2016-5626, CVE-2016-5629, CVE-2016-5630, CVE-2016-8283)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1601 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld,     and many client programs.

    The following packages have been upgraded to a newer upstream version: rh-mysql56-mysql (5.6.32).

    Security Fix(es):

    * This update fixes several vulnerabilities in the MySQL database server. Information about these flaws     can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
    (CVE-2016-3459, CVE-2016-3477, CVE-2016-3486, CVE-2016-3501, CVE-2016-3521, CVE-2016-3614, CVE-2016-3615,     CVE-2016-5439, CVE-2016-5440)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201701-01 (MariaDB and MySQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MariaDB and MySQL.
      Please review the CVE identifiers referenced below for details.
  Impact :

    Attackers could execute arbitrary code, escalate privileges, and impact       availability via unspecified vectors.
  Workaround :

    There is no known workaround at this time.

mysql-community-server was updated to 5.6.34 to fix the following issues :

  - Changes     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     34.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     33.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     32.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     31.html

  - fixed CVEs: CVE-2016-6304, CVE-2016-6662, CVE-2016-7440,     CVE-2016-5584, CVE-2016-5617, CVE-2016-5616,     CVE-2016-5626, CVE-2016-3492, CVE-2016-5629,     CVE-2016-5507, CVE-2016-8283, CVE-2016-5609,     CVE-2016-5612, CVE-2016-5627, CVE-2016-5630,     CVE-2016-8284, CVE-2016-8288, CVE-2016-3477,     CVE-2016-2105, CVE-2016-3486, CVE-2016-3501,     CVE-2016-3521, CVE-2016-3615, CVE-2016-3614,     CVE-2016-3459, CVE-2016-5439, CVE-2016-5440

  - fixes SUSE Bugs: [boo#999666], [boo#998309],     [boo#1005581], [boo#1005558], [boo#1005563],     [boo#1005562], [boo#1005566], [boo#1005555],     [boo#1005569], [boo#1005557], [boo#1005582],     [boo#1005560], [boo#1005561], [boo#1005567],     [boo#1005570], [boo#1005583], [boo#1005586],     [boo#989913], [boo#977614], [boo#989914], [boo#989915],     [boo#989919], [boo#989922], [boo#989921], [boo#989911],     [boo#989925], [boo#989926]

  - append '--ignore-db-dir=lost+found' to the mysqld     options in 'mysql-systemd-helper' script if 'lost+found'     directory is found in $datadir [boo#986251] 

  - remove syslog.target from *.service files [boo#983938]

  - add systemd to deps to build on leap and friends 

  - replace '%(_libexecdir)/systemd/system' with %(_unitdir)     macro

  - remove useless mysql@default.service [boo#971456]

  - replace all occurrences of the string '@sysconfdir@'     with '/etc' in     mysql-community-server-5.6.3-logrotate.patch as it     wasn't expanded properly [boo#990890]

  - remove '%define _rundir' as 13.1 is out of support scope

  - run 'usermod -g mysql mysql' only if mysql user is not     in mysql group. Run 'usermod -s /bin/false/ mysql' only     if mysql user doesn't have '/bin/false' shell set.

  - re-enable mysql profiling

This update for mariadb to 10.0.27 fixes the following issues :

  - release notes :

  - https://kb.askmonty.org/en/mariadb-10027-release-notes

  - https://kb.askmonty.org/en/mariadb-10026-release-notes

  - changelog :

  - https://kb.askmonty.org/en/mariadb-10027-changelog

  - https://kb.askmonty.org/en/mariadb-10026-changelog

  - fixed CVE's 10.0.27: CVE-2016-5612, CVE-2016-5630,     CVE-2016-6662 10.0.26: CVE-2016-5440, CVE-2016-3615,     CVE-2016-3521, CVE-2016-3477

  - fix: [boo#1005561], [boo#1005570], [boo#998309],     [boo#989926], [boo#989922], [boo#989919], [boo#989913]

  - requires devel packages for aio and lzo2

  - remove mariadb-10.0.21-mysql-test_main_bootstrap.patch     that is no longer needed [boo#984858] 

  - append '--ignore-db-dir=lost+found' to the mysqld     options in 'mysql-systemd-helper' script if 'lost+found'     directory is found in $datadir [boo#986251]

  - remove syslog.target from *.service files [boo#983938]

  - add systemd to deps to build on leap and friends 

  - replace '%(_libexecdir)/systemd/system' with %(_unitdir)     macro

  - remove useless mysql@default.service [boo#971456] 

  - make ORDER BY optimization functions take into account     multiple equalities [boo#949520]

  - adjust mysql-test results in order to take account of a     new option (orderby_uses_equalities) added by the     optimizer patch [boo#1003800]

  - replace all occurrences of the string '@sysconfdir@'     with '/etc' in     mysql-community-server-5.1.46-logrotate.patch as it     wasn't expanded properly [boo#990890]

The version of MySQL installed on the remote host is version 5.7.x prior to 5.7.14 and is affected by multiple issues :

 - A flaw exists in InnoDB that is triggered when selecting full-text index information schema tables for a deleted table.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in InnoDB that is triggered during the handling of 'ALTER TABLE' operations on a table with an indexed virtual column.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in a library used by MySQL.  Specifically, the Henry Spencer regex Library (rxspencer) contains an overflow condition that is triggered as certain input is not properly validated.  This may allow a context-dependent attacker to cause a buffer overflow, resulting in an unspecified impact that may include a denial of service in a process linked against the library or potentially allow the execution of arbitrary code.
 - An unspecified flaw exists related to the DML subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the InnoDB subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Memcached subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Performance Schema subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. 
 - An unspecified flaw exists related to the RBR subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Security:Audit subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Replication subcomponent. This may allow a context-dependent attacker to cause a denial of service. No further details have been provided by the vendor. 

The version of MySQL installed on the remote host is version 5.6.x prior to 5.6.32 and is affected by multiple issues :

 - A flaw exists in the 'NAME_CONST()' function that is triggered during the handling of certain arguments.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in InnoDB that is triggered when selecting full-text index information schema tables for a deleted table.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in a library used by MySQL.  Specifically, the Henry Spencer regex Library (rxspencer) contains an overflow condition that is triggered as certain input is not properly validated.  This may allow a context-dependent attacker to cause a buffer overflow, resulting in an unspecified impact that may include a denial of service in a process linked against the library or potentially allow the execution of arbitrary code.
 - An unspecified flaw exists related to the DML subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. 
 - An unspecified flaw exists related to the InnoDB subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. 
 - An unspecified flaw exists related to the Replication subcomponent. This may allow a local attacker to cause a denial of service. No further details have been provided by the vendor.

The version of MariaDB running on the remote host is 10.0.x prior to 10.0.27. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the check_log_path() function within     file sql/sys_vars.cc due to inadequate restrictions on     the ability to write to the my.cnf configuration file     and allowing the loading of configuration files from     path locations not used by current versions. An     authenticated, remote attacker can exploit this issue     by using specially crafted queries that utilize logging     functionality to create new files or append custom     content to existing files. This allows the attacker to     gain root privileges by inserting a custom .cnf file     with a 'malloc_lib=' directive pointing to specially     crafted mysql_hookandroot_lib.so file and thereby cause     MySQL to load a malicious library the next time it is     started. (CVE-2016-6662)

  - A denial of service vulnerability exists in the     emb_stmt_execute() function in file libmysqld/lib_sql.cc     when handling queries. An authenticated, remote attacker     can exploit this to crash the database.

  - A NULL pointer dereference flaw exists in the     innobase_need_rebuild() function when handling renamed     columns that allows an authenticated, remote attacker to     crash the database, resulting in a denial of service.

  - A denial of service vulnerability exists in the     ha_myisam::enable_indexes() function within file     storage/myisam/ha_myisam.cc when handling ALTER TABLE     statements. An authenticated, remote attacker can     exploit this to crash the database.

  - A denial of service vulnerability exists in the     Item_sum_std::val_real() function within file     sql/item_sum.cc when handling SUM statements. An     authenticated, remote attacker exploit this to crash the     database.

  - A denial of service vulnerability exists in the     my_double_round() function within file sql/item_func.cc     when handling specially crafted queries. An     authenticated, remote attacker can exploit this to crash     the database.

  - A denial of service vulnerability exists in the     st_select_lex_unit::cleanup() function within file     sql/sql_union.cc when handling UNION queries during JOIN     cleanup. An authenticated, remote attacker can exploit     this to crash the database.

The version of MySQL running on the remote host is 5.7.x prior to 5.7.14. It is, therefore, affected by multiple vulnerabilities :

  - Multiple unspecified flaws exist in the InnoDB     subcomponent that allow an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-3495, CVE-2016-5627, CVE-2016-5630)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5612)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5628)

  - An unspecified flaw exists in the Memcached     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-5631)

  - Multiple unspecified flaws exist in the Performance     Schema subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-5633, CVE-2016-8290)

  - An unspecified flaw exists in the RBR subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5634)

  - An unspecified flaw exists in the Security: Audit     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-5635)

  - An unspecified flaw exists in the Replication     subcomponent that allows a local attacker to cause a     denial of service condition. (CVE-2016-8284)

  - An unspecified flaw exists in the Replication     subcomponent that allows a authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-8287)

  - An unspecified flaw exists in the InnoDB subcomponent     that allows a local attacker to impact integrity and     availability. (CVE-2016-8289)

  - A denial of service vulnerability exists in InnoDB when     selecting full-text index information schema tables for     a deleted table. An authenticated, remote attacker can     exploit this to cause a segmentation fault.

  - A denial of service vulnerability exists in InnoDB when     handling ALTER TABLE operations on tables that have an     indexed virtual column. An authenticated, remote     attacker can exploit this to cause an assertion failure,     resulting in a server crash.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.6.x prior to 5.6.32. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5612)

  - Multiple unspecified flaws exist in the InnoDB     subcomponent that allow an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-5627, CVE-2016-5630)

  - An unspecified flaw exists in the Replication     subcomponent that allows a local attacker to cause a     denial of service condition. (CVE-2016-8284)

  - A denial of service vulnerability exists in the     NAME_CONST() function when handling certain unspecified     arguments. An authenticated, remote attacker can exploit     this to cause the server to exit.

  - A denial of service vulnerability exists in InnoDB when     selecting full-text index information schema tables for     a deleted table. An authenticated, remote attacker can     exploit this to cause a segmentation fault.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210177	RHEL 6 / 7 : rh-mariadb100-mariadb (RHSA-2016:2927)	Nessus	Red Hat Local Security Checks	critical
210175	RHEL 6 / 7 : rh-mysql56-mysql (RHSA-2016:1601)	Nessus	Red Hat Local Security Checks	high
96232	GLSA-201701-01 : MariaDB and MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
94756	openSUSE Security Update : mysql-community-server (openSUSE-2016-1289)	Nessus	SuSE Local Security Checks	critical
94694	openSUSE Security Update : mysql-community-server (openSUSE-2016-1283)	Nessus	SuSE Local Security Checks	critical
94649	openSUSE Security Update : mariadb (openSUSE-2016-1274)	Nessus	SuSE Local Security Checks	critical
9617	Oracle MySQL 5.7.x < 5.7.14 Multiple Vulnerabilities	Nessus Network Monitor	Database	high
9613	Oracle MySQL 5.6.x < 5.6.32 Multiple Vulnerabilities	Nessus Network Monitor	Database	high
93609	MariaDB 10.0.x < 10.0.27 Multiple Vulnerabilities	Nessus	Databases	critical
93005	MySQL 5.7.x < 5.7.14 Multiple Vulnerabilities	Nessus	Databases	medium
93004	MySQL 5.7.x < 5.7.14 Multiple Vulnerabilities	Nessus	Databases	medium
93003	MySQL 5.6.x < 5.6.32 Multiple Vulnerabilities	Nessus	Databases	medium
93002	MySQL 5.6.x < 5.6.32 Multiple Vulnerabilities	Nessus	Databases	medium

Detections

Analytics

CVE-2016-5630

medium

Tenable Plugins

critical

high

critical

critical

critical

critical

high

high

critical

medium

medium

medium

medium