Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote attackers to affect availability via unknown vectors related to Thread Pooling.

The remote host is affected by the vulnerability described in GLSA-201409-04 (MySQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MySQL. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly gain escalated privileges. A remote       attacker could send a specially crafted SQL query, possibly resulting in       a Denial of Service condition. A remote attacker could entice a user to       connect to specially crafted MySQL server, possibly resulting in       execution of arbitrary code with the privileges of the process.
  Workaround :

    There is no known workaround at this time.

MySQL was updated to version 5.5.37 to address various security issues.

More information is available at http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.h tml#AppendixMSQL and http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.h tml#AppendixMSQL .

The version of MySQL installed on the remote host is earlier than 5.6.15. Therefore, vulnerabilities likely exist in the following components :

  - Service Manager
  - GIS
  - Stored Procedure
  - Thread Pooling
  - InnoDB
  - Locking
  - Optimizer
  - Partition
  - Privileges
  - FTS
  - Performance Schema
  - Replication
  - Error Handling

The version of MySQL installed on the remote host is 5.6.x older than 5.6.14.  As such, it is reportedly affected by vulnerabilities in the following components :

  - FTS
  - InnoDB
  - Locking
  - Optimizer
  - Partition
  - Performance Schema
  - Stored Procedure
  - Thread Pooling

ID	Name	Product	Family	Type	Severity
77548	GLSA-201409-04 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
74373	SuSE 11.3 Security Update : MySQL (SAT Patch Number 9303)	Nessus	SuSE Local Security Checks	Local	critical
8082	Oracle MySQL 5.6.x < 5.6.15 Remote Code Execution	Nessus Network Monitor	Database		medium
71975	MySQL 5.6.x < 5.6.14 Multiple Vulnerabilities	Nessus	Databases	Remote	low

Detections

Analytics

CVE-2014-0433

high

Tenable Plugins

high

critical

medium

low