Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

MariaDB Server 5.5.x < 5.5.51 Multiple Vulnerabilities

High

Synopsis

The remote database server is affected by multiple attack vectors.

Description

MariaDB is a community-developed fork of the MySQL relational database. The version of MariaDB installed on the remote host is 5.5.x earlier than 5.5.51, and is therefore affected by multiple vulnerabilities :

- A denial of service vulnerability exists in the 'emb_stmt_execute()' function in file 'libmysqld/lib_sql.cc' when handling queries. An authenticated, remote attacker can exploit this to crash the database. (OSVDB 141702) - A flaw in the 'check_log_path()' function in 'sql/sys_vars.cc' that may allow an authenticated attacker with DBA permissions to gain elevated privileges. The issue is due to the program not properly restricting the ability to write to configuration files (e.g. my.cnf), combined with it loading a configuration file from specific locations that current versions do not use (e.g. '/var/lib/mysql/my.cnf'). This may allow an attacker to leverage specially crafted queries to use logging functionality to create new files or append custom content to existing files. By placing a custom '.cnf' file that MySQL will load, with a 'malloc_lib=' directive pointing to an attacker controlled 'mysql_hookandroot_lib.so' file, the attacker can cause MySQL to read the configuration file and load the malicious library the next time it starts. This can allow the attacker to gain root privileges. (OSVDB 143530) - A denial of service vulnerability exists in the 'st_select_lex_unit::cleanup()' function within file 'sql/sql_union.cc' when handling 'UNION' queries during 'JOIN' cleanup. An authenticated, remote attacker can exploit this to crash the database. (OSVDB 143756)

Solution

Upgrade to version 5.5.51 or later.