The version of MariaDB installed on the remote host is prior to 10.0.4. It is, therefore, affected by multiple vulnerabilities as referenced in the mariadb-10-0-4-release-notes advisory.

  - MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle     MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a     denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is     not properly handled when processing the binary representation of this feature, related to a numeric     calculation error. (CVE-2013-1861)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier allows remote     authenticated users to affect availability via unknown vectors related to Server Parser. (CVE-2013-3783)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and     earlier allows remote authenticated users to affect availability via unknown vectors related to Data     Manipulation Language. (CVE-2013-3793)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.69 and earlier, 5.5.31 and     earlier, and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown     vectors related to Full Text Search. (CVE-2013-3802)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.69 and earlier, 5.5.31 and     earlier, and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown     vectors related to Server Optimizer. (CVE-2013-3804)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and     earlier allows remote authenticated users to affect integrity via unknown vectors related to Audit Log.
    (CVE-2013-3809)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and     earlier allows remote authenticated users to affect availability via unknown vectors related to Server     Replication. (CVE-2013-3812)

  - Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote     authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0502)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

MariaDB 10.0.0 < 10.0.4 Multiple Vulnerabilities

medium Nessus Plugin ID 167906

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.5 Oct 3, 2023, 4:18 PM CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P" to "CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N") CVSSv2 score source (changed from "CVE-2016-0502" to "CVE-2013-3809") CVSSv3 score source (set to "CVE-2016-0502") Plugin Feed: 202310031618
Version 1.4 Mar 1, 2023, 2:07 PM CVSSv2 score source (changed from "CVE-2013-3809" to "CVE-2016-0502") CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N" to "CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P") Plugin Feed: 202303011407
Version 1.3 Nov 21, 2022, 1:49 PM Exploit attributes Plugin Feed: 202211211349
Version 1.2 Nov 18, 2022, 11:47 PM New Plugin Feed: 202211182347