Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Partition.

The version of MariaDB installed on the remote host is prior to 5.5.22. It is, therefore, affected by multiple vulnerabilities as referenced in the mariadb-5-5-22-release-notes advisory.

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and     earlier, allows remote authenticated users to affect availability, related to Server DML. (CVE-2012-1688)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and     earlier, allows remote authenticated users to affect availability via unknown vectors related to Server     Optimizer, a different vulnerability than CVE-2012-1703. (CVE-2012-1690)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.21 and earlier allows remote     authenticated users to affect availability via unknown vectors related to Partition. (CVE-2012-1697)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and     earlier, allows remote authenticated users to affect availability via unknown vectors related to Server     Optimizer, a different vulnerability than CVE-2012-1690. (CVE-2012-1703)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

MySQL Cluster 7.1.21 fixes several security issues and bugs. Please refer to the following upstream announcement for details :

http://dev.mysql.com/doc/refman/5.1/en/mysql-cluster-news-7-1.html

mysql update to version 5.5.23 fixes several security issues and bugs.
Please refer to the following upstream announcements for details :

  - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-16.html

  - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-17.html

  - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-18.html

  - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-19.html

  - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-20.html

  - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-21.html

  - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-22.html

  - http://dev.mysql.com/doc/refman/5.5/en/news-5-5-23.html

The remote host is affected by the vulnerability described in GLSA-201308-06 (MySQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MySQL. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send a specially crafted request, possibly       resulting in execution of arbitrary code with the privileges of the       application or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Versions of MySQL Community Server 5.5 earlier than 5.5.22 are potentially affected by multiple unspecified vulnerabilities.

Versions of MySQL 5.5 earlier than 5.5.22 are outdated and thus affected by the following vulnerabilities :

 - An error exists related to the included yaSSL component that could allow arbitrary code execution. (CVE-2012-0882)
 - Errors exist related to 'Server Optimizer', 'Server DML', 'Partition' and, in combination with InnoDB, 'HANDLER READ NEXT' that could allow denial of service attacks. (CVE-2012-1688, CVE-2012-1690, CVE-2012-1697, CVE-2012-1703, CVE-2012-2102)

The version of MySQL 5.5 installed on the remote host is earlier than 5.5.22. It is, therefore, affected by the following vulnerabilities :

  - An error exists related to the included yaSSL     component that could allow arbitrary code execution.
    (CVE-2012-0882)

  - Errors exist related to 'Server Optimizer',     'Server DML', 'Partition' and, in combination with     InnoDB, 'HANDLER READ NEXT' that could allow denial of     service attacks. (CVE-2012-1688, CVE-2012-1690,     CVE-2012-1697, CVE-2012-1703, CVE-2012-2102)

ID	Name	Product	Family	Severity
167863	MariaDB 5.5.0 < 5.5.22 Multiple Vulnerabilities	Nessus	Databases	critical
74626	openSUSE Security Update : mysql-cluster (openSUSE-SU-2012:0617-1)	Nessus	SuSE Local Security Checks	medium
74623	openSUSE Security Update : mysql-community-server (openSUSE-2012-273)	Nessus	SuSE Local Security Checks	medium
69508	GLSA-201308-06 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
801143	MySQL Server 5.5 < 5.5.22 Multiple Unspecified Vulnerabilities	Log Correlation Engine	Database	medium
6491	Oracle MySQL Server 5.5 < 5.5.22 Multiple Unspecified Vulnerabilities	Nessus Network Monitor	Database	high
58661	MySQL 5.5 < 5.5.22 Multiple Vulnerabilities	Nessus	Databases	high

Detections

Analytics

CVE-2012-1697

critical

Tenable Plugins

critical

medium

medium

medium

medium

high

high