The version of MariaDB running on the remote host is 10.1.x prior to 10.1.19. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the Security: Encryption     subcomponent that allows an authenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-5584)

  - A flaw exists in wolfSSL, specifically within the C     software version of AES Encryption and Decryption, due     to table lookups not properly considering cache-bank     access times. A local attacker can exploit this, via a     specially crafted application, to disclose AES keys.
    Note that this vulnerability does not affect MariaDB     packages included in Red Hat products since they're     built against system OpenSSL packages. (CVE-2016-7440)

  - A flaw exists in the fill_alter_inplace_info() function     in sql_table.cc that is triggered when altering     persistent virtual columns. An authenticated, remote     attacker can exploit this to crash the database,     resulting in a denial of service condition.

  - A flaw exists in the mysql_rm_table_no_locks() function     in sql_table.cc that is triggered during the handling of     CREATE OR REPLACE TABLE queries. An authenticated,     remote attacker can exploit this to crash the database,     resulting in a denial of service condition.

  - A flaw exists in the buf_page_is_checksum_valid*     functions in buf0buf.cc that is triggered during the     handling of encrypted information. An authenticated,     remote attacker can exploit this to crash the database,     resulting in a denial of service condition.

  - A flaw exists in the wsrep_replicate_myisam     functionality that is triggered when dropping MyISAM     tables. An authenticated, remote attacker can exploit     this to crash the database, resulting in a denial of     service condition.

Detections

Analytics

MariaDB 10.1.x < 10.1.19 Multiple Vulnerabilities

medium Nessus Plugin ID 95541

Version 1.8