The version of MariaDB running on the remote host is 5.5.x prior to 5.5.55, 10.0.x prior to 10.0.30, 10.1.x prior to 10.1.22, or 10.2.x prior to 10.2.5. It is, therefore, affected by multiple vulnerabilities :

  - A use-after-free error exists in file client.c in the     mysql_prune_stmt_list() function that allows an     unauthenticated, remote attacker to crash the database.
    (CVE-2017-3302)

  - Multiple unspecified flaws exist in the DML subcomponent     that allow an authenticated, remote attacker to cause a     denial of service condition. Note that these issues only     affect version 5.5.x. (CVE-2017-3308, CVE-2017-3456)

  - Multiple unspecified flaws exist in the Optimizer     subcomponent that allow an authenticated, remote     attacker to cause a denial of service condition. Note     that these issues only affect version 5.5.x.
    (CVE-2017-3309, CVE-2017-3453)

  - An unspecified flaw exists in the MyISAM subcomponent     that allows a local attacker to disclose sensitive     information. (CVE-2017-3313)

  - An unspecified flaw exists in the DDL subcomponent that     allows an authenticated, remote attacker to impact     integrity. Note that this issue only affects version     5.5.x. (CVE-2017-3464)

  - A denial of service vulnerability exists in the     Field_time::store_TIME_with_warning() function when     handling specially crafted INSERT queries. An     authenticated, remote attacker can exploit this to     crash the database. Note that this issue only affects     versions 5.5.x and 10.0.x.

  - A denial of service vulnerability exists in the     JOIN_CACHE::create_remaining_fields() function in file     sql_join_cache.cc when handling data caching. An     authenticated, remote attacker can exploit this to crash     the database.

  - A denial of service vulnerability exists in the     SJ_TMP_TABLE::create_sj_weedout_tmp_table() function     in file opt_subselect.cc when handling specially crafted     WHERE queries. An authenticated, remote attacker can     exploit this to crash the database. Note that this issue     only affects versions 10.0.x and 10.1.x.

  - A denial of service vulnerability exists in the     ha_partition::reset() function in file ha_partition.cc     when handling specially crafted SELECT queries. An     authenticated, remote attacker can exploit this to     crash the database.

  - A denial of service vulnerability exists in the     find_field_in_tables() function in file sql_base.cc when     handling stored procedures in EXISTS queries. An     authenticated, remote attacker can exploit this to crash     the database. Note that this issue only affects versions     10.0.x, 10.1.x, and 10.2.x.

  - A denial of service vulnerability exists in the     JOIN::drop_unused_derived_keys() function in file     sql_select.cc when handling specially crafted SELECT     statements. An authenticated, remote attacker can     exploit this to crash the database. Note that this issue     only affects versions 5.5.x, 10.1.x, and 10.2.x.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

MariaDB 5.5.x < 5.5.55 / 10.0.x < 10.0.30 / 10.1.x < 10.1.22 / 10.2.x < 10.2.5 Multiple Vulnerabilities

medium Nessus Plugin ID 99670

Version 1.9