遠端主機上執行的 MySQL 版本是 5.6.35 之前的 5.6.x 版。因此，該應用程式受到多個弱點影響：

  - Security: Encryption 子元件中存在一個不明缺陷，經驗證的遠端攻擊者可藉以造成拒絕服務情形。
    (CVE-2016-8318)

  - Replication 子元件中存在不明缺陷，經驗證的遠端攻擊者可藉以造成拒絕服務情形。
    (CVE-2016-8327)

  - Optimizer 子元件中存在一個不明缺陷，會允許經驗證的遠端攻擊者造成拒絕服務情形。(CVE-2017-3238)

  - DML 子元件中存在不明缺陷，經驗證的遠端攻擊者可藉以造成拒絕服務情形。(CVE-2017-3244)

  - InnoDB 子元件中存在一個不明缺陷，經驗證的遠端攻擊者可藉以造成拒絕服務情形。(CVE-2017-3257)

  - DDL 子元件中存在不明缺陷，經驗證的遠端攻擊者可藉以造成拒絕服務情形。(CVE-2017-3258)

  - Packaging 子元件中存在一個不明缺陷，本機攻擊者可藉以影響機密性和可用性。(CVE-2017-3265)

  - DDL 子元件中存在不明缺陷，經驗證的遠端攻擊者可藉以造成拒絕服務情形。(CVE-2017-3273)

  - Packaging 子元件中存在多個不明缺陷，本機攻擊者可藉以取得提升的權限。(CVE-2017-3291、CVE-2017-3312)

  - MyISAM 子元件中存在一個不明缺陷，本機攻擊者可藉以洩漏敏感資訊。(CVE-2017-3313)

  - Logging 子元件中存在一個不明缺陷，本機攻擊者可藉以造成拒絕服務情形。(CVE-2017-3317)

  - Error Handling 子元件中存在一個不明缺陷，本機攻擊者可藉以洩漏敏感資訊。(CVE-2017-3318)

  - mysqld_safe 元件中存在一個本機權限提升弱點，這是因為使用不安全的「rm」和「chown」命令所致。本機攻擊者可利用此弱點取得較高的權限。

  - mysqld_safe 元件中存在一個不明缺陷，經驗證的遠端攻擊者可藉以造成不明影響。

  - Optimizer 元件中有溢位情形，這是因為在處理巢狀運算式時不當驗證使用者提供的輸入所致。經驗證的遠端攻擊者可加以惡意利用，造成堆疊型緩衝區溢位，進而導致拒絕服務情形。

  - 使用 DATA DIRECTORY 子句處理 CREATE TABLE 查詢時存在一個不明缺陷。經驗證的遠端攻擊者可加以惡意利用來取得提升的權限。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

遠端主機上執行的 MySQL 版本是 5.7.17 之前的 5.7.x 版。因此，該應用程式受到多個弱點影響：

  - Security: Encryption 子元件中存在一個不明缺陷，經驗證的遠端攻擊者可藉以造成拒絕服務情形。
    (CVE-2016-8318)

  - Replication 子元件中存在不明缺陷，經驗證的遠端攻擊者可藉以造成拒絕服務情形。
    (CVE-2016-8327)

  - Optimizer 子元件中存在多個不明瑕疵，其允許經驗證的遠端攻擊者造成拒絕服務情形。
    (CVE-2017-3238、CVE-2017-3251)

  - DML 子元件中存在不明缺陷，經驗證的遠端攻擊者可藉以造成拒絕服務情形。(CVE-2017-3244)

  - Replication 子元件中存在不明缺陷，經驗證的遠端攻擊者可藉以造成拒絕服務情形。
    (CVE-2017-3256)

  - InnoDB 子元件中存在一個不明缺陷，經驗證的遠端攻擊者可藉以造成拒絕服務情形。(CVE-2017-3257)

  - DDL 子元件中存在不明缺陷，經驗證的遠端攻擊者可藉以造成拒絕服務情形。(CVE-2017-3258)

  - Packaging 子元件中存在一個不明缺陷，本機攻擊者可藉以影響機密性和可用性。(CVE-2017-3265)

  - DDL 子元件中存在不明缺陷，經驗證的遠端攻擊者可藉以造成拒絕服務情形。(CVE-2017-3273)

  - Packaging 子元件中存在多個不明缺陷，本機攻擊者可藉以取得提升的權限。(CVE-2017-3291、CVE-2017-3312)

  - MyISAM 子元件中存在一個不明缺陷，本機攻擊者可藉以洩漏敏感資訊。(CVE-2017-3313)

  - Logging 子元件中存在一個不明缺陷，本機攻擊者可藉以造成拒絕服務情形。(CVE-2017-3317)

  - Error Handling 子元件中存在一個不明缺陷，本機攻擊者可藉以洩漏敏感資訊。(CVE-2017-3318)

  - X Plugin 子元件中存在一個不明缺陷，經驗證的遠端攻擊者可藉以洩漏敏感資訊。(CVE-2017-3319)

  - Security: Encryption 子元件中存在一個不明缺陷，經驗證的遠端攻擊者可藉以洩漏敏感資訊。
    (CVE-2017-3320)

  - X Plugin 子元件中存在一個不明缺陷，經驗證的遠端攻擊者可藉以造成拒絕服務情形。(CVE-2017-3646)

  - mysqld_safe 元件中存在一個本機權限提升弱點，這是因為使用不安全的「rm」和「chown」命令所致。本機攻擊者可利用此弱點取得較高的權限。

  - mysqld_safe 元件中存在一個不明缺陷，經驗證的遠端攻擊者可藉以造成不明影響。

  - Optimizer 元件中有溢位情形，這是因為在處理巢狀運算式時不當驗證使用者提供的輸入所致。經驗證的遠端攻擊者可加以惡意利用，造成堆疊型緩衝區溢位，進而導致拒絕服務情形。

  - 使用 DATA DIRECTORY 子句處理 CREATE TABLE 查詢時存在一個不明缺陷。經驗證的遠端攻擊者可加以惡意利用來取得提升的權限。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

遠端主機受到 GLSA-201702-17 中所述的弱點影響 (MySQL：多個弱點) 在 MySQL 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。影響：攻擊者可能透過不明向量提升權限、取得存取重要資料的權限或存取所有 MySQL 伺服器可存取資料的完整權限，或造成拒絕服務情形。因應措施：目前尚無已知的因應措施。

在 MySQL 資料庫伺服器中發現數個問題。已透過將 MySQL 升級至新上游版本 5.5.54 解決這些弱點，新上游版本包括額外變更，如效能改善、錯誤修正、新功能和可能不相容的變更。如需更多詳細資訊，請參閱 MySQL 5.5 版本資訊和 Oracle 的重要修補程式更新公告：https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-54.html http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727 .html 針對 Debian 7「Wheezy」，這些問題已在 5.5.54-0+deb7u1 版本中修正。建議您升級 mysql-5.5 套件。注意：Tenable Network Security 已直接從 DLA 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

在 MySQL 資料庫伺服器中發現數個問題。已透過將 MySQL 升級至新上游版本 5.5.54 解決這些弱點，新上游版本包括額外變更，如效能改善、錯誤修正、新功能和可能不相容的變更。如需深入詳細資訊，請參閱 MySQL 5.5 版本資訊和 Oracle 的重要修補程式更新公告：- https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5 -54.html - http://www.oracle.com/technetwork/security-advisory/cpuj an2017-2881727.html

The version of MariaDB installed on the remote host is 10.0.x prior to 10.0.29, and is affected by multiple vulnerabilities :

 - A flaw exists in the 'check_duplicate_key()' function that is triggered during the handling of error messages.  This may allow an authenticated attacker to crash the database.  Depending on the database's implementation, it varies if this vulnerability requires authenticated access (e.g. daily DBA duties) or may be exploited by a remote attacker (e.g. interfaced via a web application).
 - A flaw exists in the 'JOIN::destroy()' function in 'sql/sql_select.cc' that is triggered during the handling of a specially crafted query.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'date_add_interval()' function in 'sql/sql_time.cc' that is triggered during the handling of INTERVAL arguments.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in 'sql/item_subselect.cc' that is triggered during the handling of queries from the select/unit tree.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'Item::check_well_formed_result()' function in 'sql/item.cc' that is triggered during the handling of row validation.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'lex_one_token()' function in 'sql/sql_lex.cc' that is triggered during the handling of a specially crafted query.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'merge_buffers()' function in 'sql/filesort.cc' that is triggered during the handling of 'sort_union' optimization.  This may allow an authenticated attacker to crash the database. 
 - A flaw exists in the 'Item_cache::safe_charset_converter()' function in 'sql/item.cc' that is triggered during the handling of a specially crafted subselect query item.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in 'scripts/mysqld_safe.sh' related to insecure use of certain shell utilities e.g. chown and rm when handling error log files.  This may allow a local attacker via a symlink attack to gain 'root' privileges.
 - An unspecified flaw exists related to the DDL subcomponent.  This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the DML subcomponent.  This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the InnoDB subcomponent.  This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the 'Server:Optimizer' subcomponent. This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - A flaw exists in 'scripts/mysqld_safe.sh' related to handling of the '--ledir' command line option used to specify the directory where mysqld is stored, as this value may be read from the configuration file.  This may allow a local attacker to gain elevated privileges.
 - A flaw exists in the 'packaging/rpm-oel/mysql.init' initialization script related to insecure use of the chown and chmod utilities.  This may allow a local attacker to potentially gain 'root' privileges.
 - An unspecified flaw exists related to the Logging subcomponent.  This may allow a local attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Error Handling subcomponent.  This may allow a local attacker to gain access to sensitive information.  No further details have been provided by the vendor.
 - A flaw exists in the 'handle_if_exists_options()' function in 'sql/sql_table.cc' that is triggered during the handling of a specially crafted 'ADD FOREIGN KEY' statements.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'handle_if_exists_options()' function in 'sql/sql_table.cc' that is triggered due to missing foreign keys in a second 'ALTER TABLE' statement.  This may allow an authenticated attacker to crash the database.

MariaDB is a community-developed fork of the MySQL relational database.  The version of MariaDB installed on the remote host is 5.5.x earlier than 5.5.54, and is therefore affected by multiple vulnerabilities :

 - A flaw exists in 'scripts/mysqld_safe.sh' that is triggered when handling arguments to 'malloc-lib'.  This may allow a local attacker to potentially gain elevated privileges.
 - A flaw exists in 'sql/item_subselect.cc' that is triggered during the handling of queries from the select/unit tree.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'Item::check_well_formed_result()' function in 'sql/item.cc' that is triggered during the handling of row validation.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'Rpl_filter::parse_filter_rule()' function in 'sql/rpl_filter.cc' that is triggered during the clearing of wildcards.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'lex_one_token()' function in 'sql/sql_lex.cc' that is triggered during the handling of a specially crafted query.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'merge_buffers()' function in 'sql/filesort.cc' that is triggered during the handling of 'sort_union' optimization.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'Item_cache::safe_charset_converter()' function in 'sql/item.cc' that is triggered during the handling of a specially crafted subselect query item.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'st_select_lex::is_merged_child_of()' function in 'sql/sql_lex.cc' that is triggered when handling merged views or derived tables.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in 'sql/item.cc' that is triggered during the handling of a specially crafted subquery.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in 'scripts/mysqld_safe.sh' related to insecure use of certain shell utilities e.g. chown and rm when handling error log files.  This may allow a local attacker via a symlink attack to gain 'root' privileges.
 - An unspecified flaw exists related to the DDL subcomponent.  This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the DML subcomponent.  This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the 'Server:Optimizer' subcomponent. This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - A flaw exists in 'scripts/mysqld_safe.sh' related to handling of the '--ledir' command line option used to specify the directory where mysqld is stored, as this value may be read from the configuration file.  This may allow a local attacker to gain elevated privileges.
 - A flaw exists in the 'packaging/rpm-oel/mysql.init' initialization script related to insecure use of the chown and chmod utilities.  This may allow a local attacker to potentially gain 'root' privileges.
 - An unspecified flaw exists related to the Logging subcomponent.  This may allow a local attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Error Handling subcomponent.  This may allow a local attacker to gain access to sensitive information.  No further details have been provided by the vendor.

MariaDB is a community-developed fork of the MySQL relational database. The version of MariaDB installed on the remote host is 10.1.x earlier than 10.1.21, and is therefore affected by multiple vulnerabilities :

 - A flaw exists in the 'merge_buffers()' function in 'sql/filesort.cc' that is triggered during the handling of 'sort_union' optimization.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'Item_cache::safe_charset_converter()' function in 'sql/item.cc' that is triggered during the handling of a specially crafted subselect query item.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in 'scripts/mysqld_safe.sh' related to insecure use of certain shell utilities e.g. chown and rm when handling error log files.  This may allow a local attacker via a symlink attack to gain 'root' privileges.
 - An unspecified flaw exists related to the DDL subcomponent.  This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the DML subcomponent.  This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the InnoDB subcomponent.  This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the 'Server:Optimizer' subcomponent. This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - A flaw exists in 'scripts/mysqld_safe.sh' related to handling of the '--ledir' command line option used to specify the directory where mysqld is stored, as this value may be read from the configuration file.  This may allow a local attacker to gain elevated privileges.
 - A flaw exists in the 'packaging/rpm-oel/mysql.init' initialization script related to insecure use of the chown and chmod utilities.  This may allow a local attacker to potentially gain 'root' privileges.
 - An unspecified flaw exists related to the Logging subcomponent.  This may allow a local attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Error Handling subcomponent.  This may allow a local attacker to gain access to sensitive information.  No further details have been provided by the vendor.
 - An out-of-bounds access flaw exists in the 'Item_partition_func_safe_string()' function in 'sql/item.h' that is triggered during the handling of 'information_schema.processlist' tables.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'Table_triggers_list::prepare_record_accessors()' function in 'sql/sql_trigger.cc' that is triggered during the handling of a specially crafted table.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'handle_if_exists_options()' function in 'sql/sql_table.cc' that is triggered during the handling of a specially crafted 'ADD FOREIGN KEY' statements.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'Item::decimal_precision()' function in 'sql/item.cc' that is triggered during the handling of a 'SELECT' statement in a crafted query.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'Field_time::store_TIME_with_warning()' function that is triggered when handling a specially crafted 'INSERT' query. This may allow an authenticated attacker to crash the database.

ID	Name	Product	Family	Published	Updated	Severity
95879	MySQL 5.6.x < 5.6.35 多個弱點 (2017 年 1 月 CPU)	Nessus	Databases	12/15/2016	6/3/2020	medium
95880	MySQL 5.7.x < 5.7.17 多個弱點 (2017 年 1 月 CPU) (2017 年 7 月 CPU)	Nessus	Databases	12/15/2016	11/13/2019	medium
95881	MySQL 5.7.x < 5.7.17 多個弱點 (2017 年 1 月 CPU) (2017 年 7 月 CPU)	Nessus	Databases	12/15/2016	6/3/2020	medium
97260	GLSA-201702-17：MySQL：多個弱點	Nessus	Gentoo Local Security Checks	2/21/2017	1/11/2021	medium
96732	Debian DLA-797-1：mysql-5.5 安全性更新	Nessus	Debian Local Security Checks	1/25/2017	1/11/2021	medium
96638	Debian DSA-3767-1：mysql-5.5 - 安全性更新	Nessus	Debian Local Security Checks	1/20/2017	1/11/2021	medium
9912	MariaDB Server 10.0.x < 10.0.29 Multiple Vulnerabilities	Nessus Network Monitor	Database	1/26/2017	3/6/2019	medium
9911	MariaDB Server 5.5.x < 5.5.54 Multiple Vulnerabilities	Nessus Network Monitor	Database	1/26/2017	3/6/2019	high
9915	MariaDB Server 10.1.x < 10.1.21 Multiple Vulnerabilities	Nessus Network Monitor	Database	1/26/2017	3/6/2019	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

high

medium