The version of MariaDB running on the remote host is 10.0.x prior to 10.0.22. It is, therefore, affected by multiple vulnerabilities :

  - Multiple denial of service vulnerabilities exist due to     multiple unspecified flaws in the 'Server : Partition'     subcomponent. An authenticated, remote attacker can     exploit these flaws to affect availability.
    (CVE-2015-4792, CVE-2015-4802)

  - A denial of service vulnerability exists due to an     unspecified flaw in the Query Cache subcomponent. An     authenticated, remote attacker can exploit this to     affect availability. (CVE-2015-4807)

  - A denial of service vulnerability exists due to an     unspecified flaw in the DDL subcomponent. An     authenticated, remote attacker can exploit this to     affect availability. (CVE-2015-4815)

  - An information disclosure vulnerability exists due to an     unspecified flaw in the Types subcomponent. An     authenticated, remote attacker can exploit this to gain     access to sensitive information. (CVE-2015-4826)

  - An unspecified vulnerability exists due to an     unspecified flaw in the 'Security : Privileges'     subcomponent. An authenticated, remote attacker can     exploit this to affect integrity. (CVE-2015-4830)

  - A denial of service vulnerability exists due to an     unspecified flaw in the SP subcomponent. An     authenticated, remote attacker can exploit this to     affect availability. (CVE-2015-4836)

  - Multiple denial of service vulnerabilities exist due to     multiple unspecified flaws in the DML subcomponent. An     authenticated, remote attacker can exploit these flaws     to affect availability. (CVE-2015-4858, CVE-2015-4913)

  - A denial of service vulnerability exists due to an     unspecified flaw in the InnoDB subcomponent. An     authenticated, remote attacker can exploit this to     affect availability. (CVE-2015-4861)

  - A denial of service vulnerability exists due to an     unspecified flaw in the 'Server : Parser' subcomponent.
    An authenticated, remote attacker can exploit this to     affect availability. (CVE-2015-4870)

  - A denial of service vulnerability exists due to a flaw     in the ha_partition::index_init() function that is     triggered when handling the priority queue. An     authenticated, remote attacker can exploit this, via a     specially crafted query, to cause the database to crash.

  - A denial of service vulnerability exists due to a flaw     in the Item_field::fix_outer_field() function that is     triggered when handling PREPARE statements. An     authenticated, remote attacker can exploit this, via a     specially crafted query, to cause the database to crash.

  - A denial of service vulnerability exists due to a flaw     in the convert_kill_to_deadlock_error() function that is     triggered when handling rollbacks. An authenticated,     remote attacker can exploit this, via a specially     crafted query, to cause the database to crash.

  - A denial of service vulnerability exists due to a flaw     in the no_rows_in_result() function that is triggered     when handling logical conditions. An authenticated,     remote attacker can exploit this, via a specially     crafted query, to cause the database to crash.

  - A denial of service vulnerability exists due to a flaw     in the handle_grant_struct() function that is triggered     when handling HASH updates. An authenticated, remote     attacker can exploit this, via a specially crafted     query, to cause the database to crash.

  - A denial of service vulnerability exists due to a flaw     in the is_invalid_role_name() function that is triggered     when handling ACLs with blank role names. An     authenticated, remote attacker can exploit this, via a     specially crafted query, to cause the database to crash.

  - A denial of service vulnerability exists due to a flaw     in the Item_direct_view_ref class that is triggered     when handling SELECT queries. An authenticated, remote     attacker can exploit this, via a specially crafted     query, to cause the database to crash.

  - A denial of service vulnerability exists due to a flaw     in the opt_sum_query() function that is triggered when     handling constant tables. An authenticated, remote     attacker can exploit this, via a specially crafted     query, to cause the database to crash.

Detections

Analytics

MariaDB 10.0.x < 10.0.22 Multiple Vulnerabilities

high Nessus Plugin ID 86874

Version 1.10