Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.

The remote host is affected by the vulnerability described in GLSA-201701-51 (DBD::mysql: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in DBD::mysql. Please       review the CVE identifiers referenced below for details.
  Impact :

    An attacker could cause a Denial of Service condition, execute arbitrary       code, or have other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3103-1 advisory.

    It was discovered that DBD::mysql incorrectly handled certain memory operations. A remote attacker could     use this issue to cause DBD::mysql to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2014-9906)

    Hanno Bck discovered that DBD::mysql incorrectly handled certain memory operations. A remote attacker     could use this issue to cause DBD::mysql to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-8949)

    Pali Rohr discovered that DBD::mysql incorrectly handled certain user supplied data. A remote attacker     could use this issue to cause DBD::mysql to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-1246)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for perl-DBD-MySQL

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two use-after-free vulnerabilities were discovered in DBD::mysql, a Perl DBI driver for the MySQL database server. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using DBD::mysql (application crash), or potentially to execute arbitrary code with the privileges of the user running the application.

Two use-after-free vulnerabilities were discovered in DBD::mysql, a Perl DBI driver for the MySQL database server. A remote attacker can take advantage of these flaws to cause a denial of service against an application using DBD::mysql (application crash), or potentially to execute arbitrary code with the privileges of the user running the application.

For Debian 7 'Wheezy', these problems have been fixed in version 4.021-1+deb7u1.

We recommend that you upgrade your libdbd-mysql-perl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
96686	GLSA-201701-51 : DBD::mysql: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
94069	Ubuntu 14.04 LTS : DBD::mysql vulnerabilities (USN-3103-1)	Nessus	Ubuntu Local Security Checks	critical
92883	Fedora 23 : perl-DBD-MySQL (2016-bb0b94f8db)	Nessus	Fedora Local Security Checks	critical
92733	Fedora 24 : perl-DBD-MySQL (2016-4274c906e7)	Nessus	Fedora Local Security Checks	critical
92643	Debian DSA-3635-1 : libdbd-mysql-perl - security update	Nessus	Debian Local Security Checks	critical
92639	Debian DLA-576-1 : libdbd-mysql-perl security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2015-8949

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical