The version of MariaDB running on the remote host is 10.1.x prior to 10.1.10. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the Server : Options     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0505)

  - An unspecified flaw exists in the Client subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-0546)

  - An unspecified flaw exists in the Server : DML     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0596)

  - Multiple unspecified flaws exist in the Server :
    Optimizer subcomponent that allows an authenticated,     remote attacker to cause a denial of service.
    (CVE-2016-0597, CVE-2016-0598, CVE-2016-0616)

  - An unspecified flaw exists in the Server : InnoDB     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0600)

  - An unspecified flaw exists in the Server : Security :
    Encryption subcomponent that allows an authenticated,     remote attacker to impact integrity. (CVE-2016-0606,     CVE-2016-0609)

  - An unspecified flaw exists in the Server : UDF     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0608)     
  - A race condition exists due to debian.cnf being created     with world-readable permissions for a small period of     time during initial installation. A local attacker can     exploit this to disclose the debian-sys-maint password.

  - A flaw exists in the decimal2string() function due to     improper handling of decimal precision greater than 40.
    An authenticated, remote attacker can exploit this to     crash the server, resulting in a denial of service     condition.

  - A security bypass vulnerability exists due to an     incorrect implementation of the --ssl-verify-server-cert     option. A man-in-the-middle attacker can exploit this to     replace the server SSL certificate, resulting in a     bypass of the client-side hostname verification.
    (MDEV-9212)

Detections

Analytics

MariaDB 10.1.x < 10.1.10 Multiple Vulnerabilities

medium Nessus Plugin ID 87726

Version 1.17