Detections
Analytics
MySQL 5.5 < 5.5.24 Security Bypass Vulnerability
medium Nessus Plugin ID 59449
Language:
Synopsis
The remote database server is affected by a security bypass vulnerability.Description
The version of MySQL 5.5 installed on the remote host is earlier than 5.5.24 and is, therefore, affected by the following vulnerabilities :- Several errors exist related to 'GIS Extension', 'Server', 'InnoDB' and 'Server Optimizer' components that can allow denial of service attacks.
(CVE-2012-0540, CVE-2012-1734, CVE-2012-1735, CVE-2012-1756, CVE-2012-1757)
- A security bypass vulnerability exists that occurs due to improper casting during user login sessions.
(Bug #64884 / CVE-2012-2122)
- An error exists related to key length and sort order index that can lead to application crashes.
(Bug #59387 / CVE-2012-2749)
Solution
Upgrade to MySQL version 5.5.24 or later.See Also
https://seclists.org/oss-sec/2012/q2/493
Plugin Details
Severity: Medium
ID: 59449
File Name: mysql_5_5_24.nasl
Version: 1.19
Type: remote
Family: Databases
Published: 6/11/2012
Updated: 12/4/2019
Configuration: Enable paranoid mode
Supported Sensors: Frictionless Assessment Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
CVSS v2
Risk Factor: Medium
Base Score: 5.1
Temporal Score: 4.2
Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2012-2122
Vulnerability Information
CPE: cpe:/a:mysql:mysql
Required KB Items: Settings/ParanoidReport
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/7/2012
Vulnerability Publication Date: 6/11/2012
Exploitable With
CANVAS (CANVAS)
Reference Information
CVE: CVE-2012-0540, CVE-2012-1734, CVE-2012-1735, CVE-2012-1756, CVE-2012-1757, CVE-2012-2122, CVE-2012-2749