The version of MariaDB running on the remote host is 10.0.x prior to 10.0.23. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the Server : Options     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0505)

  - An unspecified flaw exists in the Client subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-0546)

  - An unspecified flaw exists in the Server : DML     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0596)

  - Multiple unspecified flaws exist in the Server :
    Optimizer subcomponent that allows an authenticated,     remote attacker to cause a denial of service.
    (CVE-2016-0597, CVE-2016-0598, CVE-2016-0616)

  - An unspecified flaw exists in the Server : InnoDB     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0600)

  - An unspecified flaw exists in the Server : Security :
    Encryption subcomponent that allows an authenticated,     remote attacker to impact integrity. (CVE-2016-0606,     CVE-2016-0609)

  - An unspecified flaw exists in the Server : UDF     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0608)

  - A flaw exists in the check_fk_parent_table_access()     function in sql_parse.cc that is triggered when     performing database name conversions. An authenticated,     remote attacker can exploit this to crash the database,     resulting in a denial of service.

  - An overflow condition exists in the XMLColumns()     function in tabxml.cpp due to improper validation of     user-supplied input. An authenticated, remote attacker     can exploit this to cause a buffer overflow, resulting     in a denial of service condition or the execution of     arbitrary code.

  - An unspecified flaw exists that is triggered when     handling UPDATE queries with JOIN. An authenticated,     remote attacker can exploit this to crash the database,     resulting in a denial of service.

  - A flaw exists in mysql_upgrade due to leaking plaintext     password information to the process listing when     spawning a shell process to execute mysqlcheck. A local     attacker can exploit this to disclose sensitive password     information.

  - An unspecified flaw exists that is triggered during the     handling of 'View' or 'Derived' fields. An     authenticated, remote attacker can exploit this to crash     the database, resulting in a denial of service.

  - An unspecified flaw exists in i_s.cc that is triggered     during the handling of buffer pages. An authenticated,     remote attacker can exploit this to crash the database,     resulting in a denial of service.

  - An unspecified flaw exists in ha_innodb.cc that is     triggered when handling lower case table names. An     authenticated, remote attacker can exploit this to crash     the database, resulting in a denial of service.

  - A flaw exists in the row_merge_sort() function that is     triggered when handling FT-index creation. An     authenticated, remote attacker can exploit this to crash     the database, resulting in a denial of service.

  - An overflow condition exists in the decimal2string()     function in decimal.c due to improper validation of     user-supplied input when handling decimals in SELECT     statements. An authenticated, remote attacker can     exploit this to crash the database, resulting in a     denial of service condition.

  - A flaw exists in the mysql_prepare_create_table()     function due to improper handling of a comma buffer that     is greater than zero. An authenticated, remote attacker     can exploit this to cause a denial of service condition.

  - A flaw exists in the decimal2string() function due to     improper handling of decimal precision greater than 40.
    An authenticated, remote attacker can exploit this to     crash the server, resulting in a denial of service     condition.

  - A security bypass vulnerability exists due to an     incorrect implementation of the --ssl-verify-server-cert     option. A man-in-the-middle attacker can exploit this to     replace the server SSL certificate, resulting in a     bypass of the client-side hostname verification.
    (MDEV-9212)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

MariaDB 10.0.x < 10.0.23 Multiple Vulnerabilities

medium Nessus Plugin ID 87725

Version 1.17