Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-6664. Reason: This candidate is a reservation duplicate of CVE-2016-6664. Notes: All CVE users should reference CVE-2016-6664 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

redhat RHSA-2018:0279: RHSA-2018:0279: rh-mariadb100-mariadb security update (Moderate)

redhat RHSA-2018:0574: RHSA-2018:0574: rh-mariadb101-mariadb and rh-mariadb101-galera security and bug fix update (Moderate)

redhat RHSA-2016:2749: RHSA-2016:2749: rh-mysql56-mysql security update (Important)

redhat RHSA-2016:2130: RHSA-2016:2130: mysql55-mysql security update (Important)

According to the versions of the mariadb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the mysql and mysqldump tools     did not correctly handle database and table names     containing newline characters. A database user with     privileges to create databases or tables could cause     the mysql command to execute arbitrary shell or SQL     commands while restoring database backup created using     the mysqldump tool. (CVE-2016-5483, CVE-2017-3600)

  - A flaw was found in the way the mysqld_safe script     handled creation of error log file. The mysql operating     system user could use this flaw to escalate their     privileges to root. (CVE-2016-5617, CVE-2016-6664)

  - Multiple flaws were found in the way the MySQL init     script handled initialization of the database data     directory and permission setting on the error log file.
    The mysql operating system user could use these flaws     to escalate their privileges to root. (CVE-2017-3265)

  - It was discovered that the mysqld_safe script honored     the ledir option value set in a MySQL configuration     file. A user able to modify one of the MySQL     configuration files could use this flaw to escalate     their privileges to root. (CVE-2017-3291)

  - Multiple flaws were found in the way the mysqld_safe     script handled creation of error log file. The mysql     operating system user could use these flaws to escalate     their privileges to root. (CVE-2017-3312)

  - A flaw was found in the way MySQL client library     (libmysqlclient) handled prepared statements when     server connection was lost. A malicious server or a     man-in-the-middle attacker could possibly use this flaw     to crash an application using libmysqlclient.
    (CVE-2017-3302)

  - This update fixes several vulnerabilities in the     MariaDB database server. Information about these flaws     can be found on the Oracle Critical Patch Update     Advisory page, listed in the References section.
    (CVE-2017-3238, CVE-2017-3243, CVE-2017-3244,     CVE-2017-3258, CVE-2017-3308, CVE-2017-3309,     CVE-2017-3313, CVE-2017-3317, CVE-2017-3318,     CVE-2017-3453, CVE-2017-3456, CVE-2017-3464)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for mariadb is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version:
mariadb (5.5.56). (BZ#1458933)

Security Fix(es) :

* It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or tables could cause the mysql command to execute arbitrary shell or SQL commands while restoring database backup created using the mysqldump tool. (CVE-2016-5483, CVE-2017-3600)

* A flaw was found in the way the mysqld_safe script handled creation of error log file. The mysql operating system user could use this flaw to escalate their privileges to root. (CVE-2016-5617, CVE-2016-6664)

* Multiple flaws were found in the way the MySQL init script handled initialization of the database data directory and permission setting on the error log file. The mysql operating system user could use these flaws to escalate their privileges to root. (CVE-2017-3265)

* It was discovered that the mysqld_safe script honored the ledir option value set in a MySQL configuration file. A user able to modify one of the MySQL configuration files could use this flaw to escalate their privileges to root. (CVE-2017-3291)

* Multiple flaws were found in the way the mysqld_safe script handled creation of error log file. The mysql operating system user could use these flaws to escalate their privileges to root. (CVE-2017-3312)

* A flaw was found in the way MySQL client library (libmysqlclient) handled prepared statements when server connection was lost. A malicious server or a man-in-the-middle attacker could possibly use this flaw to crash an application using libmysqlclient.
(CVE-2017-3302)

* This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
(CVE-2017-3238, CVE-2017-3243, CVE-2017-3244, CVE-2017-3258, CVE-2017-3308, CVE-2017-3309, CVE-2017-3313, CVE-2017-3317, CVE-2017-3318, CVE-2017-3453, CVE-2017-3456, CVE-2017-3464)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The following packages have been upgraded to a later upstream version:
mariadb (5.5.56).

Security Fix(es) :

  - It was discovered that the mysql and mysqldump tools did     not correctly handle database and table names containing     newline characters. A database user with privileges to     create databases or tables could cause the mysql command     to execute arbitrary shell or SQL commands while     restoring database backup created using the mysqldump     tool. (CVE-2016-5483, CVE-2017-3600)

  - A flaw was found in the way the mysqld_safe script     handled creation of error log file. The mysql operating     system user could use this flaw to escalate their     privileges to root. (CVE-2016-5617, CVE-2016-6664)

  - Multiple flaws were found in the way the MySQL init     script handled initialization of the database data     directory and permission setting on the error log file.
    The mysql operating system user could use these flaws to     escalate their privileges to root. (CVE-2017-3265)

  - It was discovered that the mysqld_safe script honored     the ledir option value set in a MySQL configuration     file. A user able to modify one of the MySQL     configuration files could use this flaw to escalate     their privileges to root. (CVE-2017-3291)

  - Multiple flaws were found in the way the mysqld_safe     script handled creation of error log file. The mysql     operating system user could use these flaws to escalate     their privileges to root. (CVE-2017-3312)

  - A flaw was found in the way MySQL client library     (libmysqlclient) handled prepared statements when server     connection was lost. A malicious server or a     man-in-the-middle attacker could possibly use this flaw     to crash an application using libmysqlclient.
    (CVE-2017-3302)

(CVE-2017-3238, CVE-2017-3243, CVE-2017-3244, CVE-2017-3258, CVE-2017-3308, CVE-2017-3309, CVE-2017-3313, CVE-2017-3317, CVE-2017-3318, CVE-2017-3453, CVE-2017-3456, CVE-2017-3464)

From Red Hat Security Advisory 2017:2192 :

An update for mariadb is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version:
mariadb (5.5.56). (BZ#1458933)

Security Fix(es) :

* It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or tables could cause the mysql command to execute arbitrary shell or SQL commands while restoring database backup created using the mysqldump tool. (CVE-2016-5483, CVE-2017-3600)

* A flaw was found in the way the mysqld_safe script handled creation of error log file. The mysql operating system user could use this flaw to escalate their privileges to root. (CVE-2016-5617, CVE-2016-6664)

* Multiple flaws were found in the way the MySQL init script handled initialization of the database data directory and permission setting on the error log file. The mysql operating system user could use these flaws to escalate their privileges to root. (CVE-2017-3265)

* It was discovered that the mysqld_safe script honored the ledir option value set in a MySQL configuration file. A user able to modify one of the MySQL configuration files could use this flaw to escalate their privileges to root. (CVE-2017-3291)

* Multiple flaws were found in the way the mysqld_safe script handled creation of error log file. The mysql operating system user could use these flaws to escalate their privileges to root. (CVE-2017-3312)

* A flaw was found in the way MySQL client library (libmysqlclient) handled prepared statements when server connection was lost. A malicious server or a man-in-the-middle attacker could possibly use this flaw to crash an application using libmysqlclient.
(CVE-2017-3302)

* This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
(CVE-2017-3238, CVE-2017-3243, CVE-2017-3244, CVE-2017-3258, CVE-2017-3308, CVE-2017-3309, CVE-2017-3313, CVE-2017-3317, CVE-2017-3318, CVE-2017-3453, CVE-2017-3456, CVE-2017-3464)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The MySQL project reports :

- CVE-2016-3492: Remote security vulnerability in 'Server: Optimizer' sub component.

- CVE-2016-5616, CVE-2016-6663: Race condition allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.

- CVE-2016-5617, CVE-2016-6664: mysqld_safe, when using file-based logging, allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files.

- CVE-2016-5624: Remote security vulnerability in 'Server: DML' sub component.

- CVE-2016-5626: Remote security vulnerability in 'Server: GIS' sub component.

- CVE-2016-5629: Remote security vulnerability in 'Server: Federated' sub component.

- CVE-2016-8283: Remote security vulnerability in 'Server: Types' sub component.

mysql-community-server was updated to 5.6.34 to fix the following issues :

  - Changes     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     34.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     33.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     32.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     31.html

  - fixed CVEs: CVE-2016-6304, CVE-2016-6662, CVE-2016-7440,     CVE-2016-5584, CVE-2016-5617, CVE-2016-5616,     CVE-2016-5626, CVE-2016-3492, CVE-2016-5629,     CVE-2016-5507, CVE-2016-8283, CVE-2016-5609,     CVE-2016-5612, CVE-2016-5627, CVE-2016-5630,     CVE-2016-8284, CVE-2016-8288, CVE-2016-3477,     CVE-2016-2105, CVE-2016-3486, CVE-2016-3501,     CVE-2016-3521, CVE-2016-3615, CVE-2016-3614,     CVE-2016-3459, CVE-2016-5439, CVE-2016-5440

  - fixes SUSE Bugs: [boo#999666], [boo#998309],     [boo#1005581], [boo#1005558], [boo#1005563],     [boo#1005562], [boo#1005566], [boo#1005555],     [boo#1005569], [boo#1005557], [boo#1005582],     [boo#1005560], [boo#1005561], [boo#1005567],     [boo#1005570], [boo#1005583], [boo#1005586],     [boo#989913], [boo#977614], [boo#989914], [boo#989915],     [boo#989919], [boo#989922], [boo#989921], [boo#989911],     [boo#989925], [boo#989926]

  - append '--ignore-db-dir=lost+found' to the mysqld     options in 'mysql-systemd-helper' script if 'lost+found'     directory is found in $datadir [boo#986251] 

  - remove syslog.target from *.service files [boo#983938]

  - add systemd to deps to build on leap and friends 

  - replace '%(_libexecdir)/systemd/system' with %(_unitdir)     macro

  - remove useless mysql@default.service [boo#971456]

  - replace all occurrences of the string '@sysconfdir@'     with '/etc' in     mysql-community-server-5.6.3-logrotate.patch as it     wasn't expanded properly [boo#990890]

  - remove '%define _rundir' as 13.1 is out of support scope

  - run 'usermod -g mysql mysql' only if mysql user is not     in mysql group. Run 'usermod -s /bin/false/ mysql' only     if mysql user doesn't have '/bin/false' shell set.

  - re-enable mysql profiling

The version of MySQL running on the remote host is 5.6.x prior to 5.6.34. It is, therefore, affected by multiple vulnerabilities :

  - Multiple integer overflow conditions exist in s3_srvr.c,     ssl_sess.c, and t1_lib.c due to improper use of pointer     arithmetic for heap-buffer boundary checks. An     unauthenticated, remote attacker can exploit this to     cause a denial of service. (CVE-2016-2177)

  - An information disclosure vulnerability exists in the     dsa_sign_setup() function in dsa_ossl.c due to a failure     to properly ensure the use of constant-time operations.
    An unauthenticated, remote attacker can exploit this,     via a timing side-channel attack, to disclose DSA key     information. (CVE-2016-2178)

  - A denial of service vulnerability exists in the DTLS     implementation due to a failure to properly restrict the     lifetime of queue entries associated with unused     out-of-order messages. An unauthenticated, remote     attacker can exploit this, by maintaining multiple     crafted DTLS sessions simultaneously, to exhaust memory.
    (CVE-2016-2179)

  - An out-of-bounds read error exists in the X.509 Public     Key Infrastructure Time-Stamp Protocol (TSP)     implementation. An unauthenticated, remote attacker can     exploit this, via a crafted time-stamp file that is     mishandled by the 'openssl ts' command, to cause     denial of service or to disclose sensitive information.
    (CVE-2016-2180)

  - A denial of service vulnerability exists in the     Anti-Replay feature in the DTLS implementation due to     improper handling of epoch sequence numbers in records.
    An unauthenticated, remote attacker can exploit this,     via spoofed DTLS records, to cause legitimate packets to     be dropped. (CVE-2016-2181)

  - An overflow condition exists in the BN_bn2dec() function     in bn_print.c due to improper validation of     user-supplied input when handling BIGNUM values. An     unauthenticated, remote attacker can exploit this to     crash the process. (CVE-2016-2182)

  - A vulnerability exists, known as SWEET32, in the 3DES     and Blowfish algorithms due to the use of weak 64-bit     block ciphers by default. A man-in-the-middle attacker     who has sufficient resources can exploit this     vulnerability, via a 'birthday' attack, to detect a     collision that leaks the XOR between the fixed secret     and a known plaintext, allowing the disclosure of the     secret text, such as secure HTTPS cookies, and possibly     resulting in the hijacking of an authenticated session.
    (CVE-2016-2183)

  - An unspecified flaw exists in the Optimizer subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-3492)

  - An unspecified flaw exists in the Security: Encryption     subcomponent that allows an authenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-5584)

  - An unspecified flaw exists in the MyISAM subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-5616)

  - An unspecified flaw exists in the Error Handling     subcomponent that allows a local attacker to gain     elevated privileges. (CVE-2016-5617)

  - An unspecified flaw exists in the GIS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5626)

  - An unspecified flaw exists in the Federated subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5629)

  - A flaw exists in the tls_decrypt_ticket() function in     t1_lib.c due to improper handling of ticket HMAC     digests. An unauthenticated, remote attacker can exploit     this, via a ticket that is too short, to crash the     process, resulting in a denial of service.
    (CVE-2016-6302)

  - An integer overflow condition exists in the     MDC2_Update() function in mdc2dgst.c due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a heap-based     buffer overflow, resulting in a denial of service     condition or possibly the execution of arbitrary code.
    (CVE-2016-6303)

  - A flaw exists in the ssl_parse_clienthello_tlsext()     function in t1_lib.c due to improper handling of overly     large OCSP Status Request extensions from clients. An     unauthenticated, remote attacker can exploit this, via     large OCSP Status Request extensions, to exhaust memory     resources, resulting in a denial of service condition.
    (CVE-2016-6304)

  - An out-of-bounds read error exists in the certificate     parser that allows an unauthenticated, remote attacker     to cause a denial of service via crafted certificate     operations. (CVE-2016-6306)

  - A flaw exists in the check_log_path() function within     file sql/sys_vars.cc due to inadequate restrictions on     the ability to write to the my.cnf configuration file     and allowing the loading of configuration files from     path locations not used by current versions. An     authenticated, remote attacker can exploit this issue     by using specially crafted queries that utilize logging     functionality to create new files or append custom     content to existing files. This allows the attacker to     gain root privileges by inserting a custom .cnf file     with a 'malloc_lib=' directive pointing to specially     crafted mysql_hookandroot_lib.so file and thereby cause     MySQL to load a malicious library the next time it is     started. (CVE-2016-6662)

  - A flaw exists in wolfSSL, specifically within the C     software version of AES Encryption and Decryption, due     to table lookups not properly considering cache-bank     access times. A local attacker can exploit this, via a     specially crafted application, to disclose AES keys.
    (CVE-2016-7440)

  - An unspecified flaw exists in the Types subcomponent     that allows an authenticated, remote attacker to cause     a denial of service condition.(CVE-2016-8283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.5.x prior to 5.5.53. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the Optimizer subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-3492)

  - An unspecified flaw exists in the Security: Encryption     subcomponent that allows an authenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-5584)

  - An unspecified flaw exists in the MyISAM subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-5616)

  - An unspecified flaw exists in the Error Handling     subcomponent that allows a local attacker to gain     elevated privileges. (CVE-2016-5617)

  - An unspecified flaw exists in the GIS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5626)

  - An unspecified flaw exists in the Federated subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5629)

  - A flaw exists in the check_log_path() function within     file sql/sys_vars.cc due to inadequate restrictions on     the ability to write to the my.cnf configuration file     and allowing the loading of configuration files from     path locations not used by current versions. An     authenticated, remote attacker can exploit this issue     by using specially crafted queries that utilize logging     functionality to create new files or append custom     content to existing files. This allows the attacker to     gain root privileges by inserting a custom .cnf file     with a 'malloc_lib=' directive pointing to specially     crafted mysql_hookandroot_lib.so file and thereby cause     MySQL to load a malicious library the next time it is     started. (CVE-2016-6662)

  - A flaw exists in wolfSSL, specifically within the C     software version of AES Encryption and Decryption, due     to table lookups not properly considering cache-bank     access times. A local attacker can exploit this, via a     specially crafted application, to disclose AES keys.
    (CVE-2016-7440)

  - An unspecified flaw exists in the Types subcomponent     that allows an authenticated, remote attacker to cause     a denial of service condition.(CVE-2016-8283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.6.x prior to 5.6.34. It is, therefore, affected by multiple vulnerabilities :

  - Multiple integer overflow conditions exist in s3_srvr.c,     ssl_sess.c, and t1_lib.c due to improper use of pointer     arithmetic for heap-buffer boundary checks. An     unauthenticated, remote attacker can exploit this to     cause a denial of service. (CVE-2016-2177)

  - An information disclosure vulnerability exists in the     dsa_sign_setup() function in dsa_ossl.c due to a failure     to properly ensure the use of constant-time operations.
    An unauthenticated, remote attacker can exploit this,     via a timing side-channel attack, to disclose DSA key     information. (CVE-2016-2178)

  - A denial of service vulnerability exists in the DTLS     implementation due to a failure to properly restrict the     lifetime of queue entries associated with unused     out-of-order messages. An unauthenticated, remote     attacker can exploit this, by maintaining multiple     crafted DTLS sessions simultaneously, to exhaust memory.
    (CVE-2016-2179)

  - An out-of-bounds read error exists in the X.509 Public     Key Infrastructure Time-Stamp Protocol (TSP)     implementation. An unauthenticated, remote attacker can     exploit this, via a crafted time-stamp file that is     mishandled by the 'openssl ts' command, to cause     denial of service or to disclose sensitive information.
    (CVE-2016-2180)

  - A denial of service vulnerability exists in the     Anti-Replay feature in the DTLS implementation due to     improper handling of epoch sequence numbers in records.
    An unauthenticated, remote attacker can exploit this,     via spoofed DTLS records, to cause legitimate packets to     be dropped. (CVE-2016-2181)

  - An overflow condition exists in the BN_bn2dec() function     in bn_print.c due to improper validation of     user-supplied input when handling BIGNUM values. An     unauthenticated, remote attacker can exploit this to     crash the process. (CVE-2016-2182)

  - A vulnerability exists, known as SWEET32, in the 3DES     and Blowfish algorithms due to the use of weak 64-bit     block ciphers by default. A man-in-the-middle attacker     who has sufficient resources can exploit this     vulnerability, via a 'birthday' attack, to detect a     collision that leaks the XOR between the fixed secret     and a known plaintext, allowing the disclosure of the     secret text, such as secure HTTPS cookies, and possibly     resulting in the hijacking of an authenticated session.
    (CVE-2016-2183)

  - An unspecified flaw exists in the Optimizer subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-3492)

  - An unspecified flaw exists in the Security: Encryption     subcomponent that allows an authenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-5584)

  - An unspecified flaw exists in the MyISAM subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-5616)

  - An unspecified flaw exists in the Error Handling     subcomponent that allows a local attacker to gain     elevated privileges. (CVE-2016-5617)

  - An unspecified flaw exists in the GIS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5626)

  - An unspecified flaw exists in the Federated subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5629)

  - A flaw exists in the tls_decrypt_ticket() function in     t1_lib.c due to improper handling of ticket HMAC     digests. An unauthenticated, remote attacker can exploit     this, via a ticket that is too short, to crash the     process, resulting in a denial of service.
    (CVE-2016-6302)

  - An integer overflow condition exists in the     MDC2_Update() function in mdc2dgst.c due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a heap-based     buffer overflow, resulting in a denial of service     condition or possibly the execution of arbitrary code.
    (CVE-2016-6303)

  - A flaw exists in the ssl_parse_clienthello_tlsext()     function in t1_lib.c due to improper handling of overly     large OCSP Status Request extensions from clients. An     unauthenticated, remote attacker can exploit this, via     large OCSP Status Request extensions, to exhaust memory     resources, resulting in a denial of service condition.
    (CVE-2016-6304)

  - An out-of-bounds read error exists in the certificate     parser that allows an unauthenticated, remote attacker     to cause a denial of service via crafted certificate     operations. (CVE-2016-6306)

  - A flaw exists in the check_log_path() function within     file sql/sys_vars.cc due to inadequate restrictions on     the ability to write to the my.cnf configuration file     and allowing the loading of configuration files from     path locations not used by current versions. An     authenticated, remote attacker can exploit this issue     by using specially crafted queries that utilize logging     functionality to create new files or append custom     content to existing files. This allows the attacker to     gain root privileges by inserting a custom .cnf file     with a 'malloc_lib=' directive pointing to specially     crafted mysql_hookandroot_lib.so file and thereby cause     MySQL to load a malicious library the next time it is     started. (CVE-2016-6662)

  - A flaw exists in wolfSSL, specifically within the C     software version of AES Encryption and Decryption, due     to table lookups not properly considering cache-bank     access times. A local attacker can exploit this, via a     specially crafted application, to disclose AES keys.
    (CVE-2016-7440)

  - An unspecified flaw exists in the Types subcomponent     that allows an authenticated, remote attacker to cause     a denial of service condition.(CVE-2016-8283)

The version of MySQL installed on the remote host is version 5.7.x prior to 5.7.15 and is affected by multiple issues :

 - A flaw exists related to the way 'REPAIR TABLE' uses temporary files.  This may allow an authenticated attacker to gain elevated privileges.
 - A flaw exists in InnoDB that is triggered during the handling of an operation that dropped and created a full-text search table.  This may allow an authenticated attacker to trigger an assertion and cause a denial of service.
 - A flaw exists in InnoDB that is triggered when accessing full-text search auxiliary tables while dropping the indexed table.  This may allow an authenticated attacker to trigger an assertion and cause a denial of service.
 - An overflow condition exists that is triggered as certain input is not properly validated when handling long integer values in 'MEDIUMINT' columns.  This may allow an authenticated attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A flaw exists in the 'validate_password' plugin that is triggered as rejected passwords are logged in plaintext on the error log.  This may allow a local attacker to gain access to passwords that did not meet the password policy, but may potentially be very close to the password ultimately chosen and accepted.
 - A flaw exists in InnoDB that is triggered during the handling of an 'ALTER TABLE ... ENCRYPTION=Y, ALGORITHM=COPY' operation on a table residing in the system tablespace.  This may allow an authenticated attacker to crash the server.
 - An unspecified flaw exists related to the Optimizer subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. (CVE-2016-3492)
 - An unspecified flaw exists related to the InnoDB subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. (CVE-2016-5507)
 - An unspecified flaw exists related to the MyISAM subcomponent. This may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor. (CVE-2016-5616)
 - An unspecified flaw exists related to the Error Handling subcomponent. This may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor. (CVE-2016-5617)
 - An unspecified flaw exists related to the Packaging subcomponent. This may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor. (CVE-2016-5625)
 - An unspecified flaw exists related to the GIS subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. (CVE-2016-5626)
 - An unspecified flaw exists related to the Federated subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. (CVE-2016-5629)
 - An unspecified flaw exists related to the Optimizer subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. (2016-5632)
 - An unspecified flaw exists related to the Types subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. (CVE-2016-8283)
 - An unspecified flaw exists related to the Security: Privileges subcomponent. This may allow an authenticated remote attacker to disclose potentially sensitive information. No further details have been provided by the vendor. (CVE-2016-8286)

The version of MySQL installed on the remote host is version 5.6.x prior to 5.6.33 and is affected by multiple issues :

 - A flaw exists related to the way 'REPAIR TABLE' uses temporary files.  This may allow an authenticated attacker to gain elevated privileges.
 - A flaw exists in InnoDB that is triggered during the handling of an operation that dropped and created a full-text search table. This may allow an authenticated attacker to trigger an assertion and cause a denial of service.
 - A flaw exists in InnoDB that is triggered when accessing full-text search auxiliary tables while dropping the indexed table.  This may allow an authenticated attacker to trigger an assertion and cause a denial of service.
 - An overflow condition exists that is triggered as certain input is not properly validated when handling long integer values in 'MEDIUMINT' columns.  This may allow an authenticated attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A flaw exists that is triggered during the handling of prepared statements that use a parameter in the select list of a derived table that was part of a join.  This may allow an authenticated attacker to crash the server.
 - An unspecified flaw exists related to the Error Handling subcomponent. This may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the MyISAM subcomponent. This may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the GIS subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Optimizer subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Federated subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the InnoDB subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Types subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.

The version of MySQL installed on the remote host is version 5.5.x prior to 5.5.52 and is affected by multiple issues :

 - A flaw exists related to the way 'REPAIR TABLE' uses temporary files.  This may allow an authenticated attacker to gain elevated privileges.
 - An overflow condition exists that is triggered as certain input is not properly validated when handling long integer values in 'MEDIUMINT' columns.  This may allow an authenticated attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A flaw exists that is triggered during the handling of prepared statements that use a parameter in the select list of a derived table that was part of a join.  This may allow an authenticated attacker to crash the server.
 - An unspecified flaw exists related to the Error Handling subcomponent. This may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the MyISAM subcomponent. This may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the DML subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the GIS subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Optimizer subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Federated subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Types subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.

The version of MySQL running on the remote host is 5.7.x prior to 5.7.15. It is, therefore, affected by multiple vulnerabilities :

  - Multiple unspecified flaws exist in the Optimizer     subcomponent that allow an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-3492, CVE-2016-5632)

  - An unspecified flaw exists in the InnoDB subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5507)

  - An unspecified flaw exists in the MyISAM subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-5616)

  - An unspecified flaw exists in the Error Handling     subcomponent that allows a local attacker to gain     elevated privileges. (CVE-2016-5617)

  - An unspecified flaw exists in the Packaging subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-5625)

  - An unspecified flaw exists in the GIS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5626)

  - An unspecified flaw exists in the Federated subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5629)

  - A flaw exists in the check_log_path() function within     file sql/sys_vars.cc due to inadequate restrictions on     the ability to write to the my.cnf configuration file     and allowing the loading of configuration files from     path locations not used by current versions. An     authenticated, remote attacker can exploit this issue     by using specially crafted queries that utilize logging     functionality to create new files or append custom     content to existing files. This allows the attacker to     gain root privileges by inserting a custom .cnf file     with a 'malloc_lib=' directive pointing to specially     crafted mysql_hookandroot_lib.so file and thereby cause     MySQL to load a malicious library the next time it is     started. (CVE-2016-6662)

  - An unspecified flaw exists that allows an authenticated,     remote attacker to bypass restrictions and create the     /var/lib/mysql/my.cnf file with custom contents without     the FILE privilege requirement. (CVE-2016-6663)     
  - An unspecified flaw exists in the Types subcomponent     that allows an authenticated, remote attacker to cause     a denial of service condition.(CVE-2016-8283)

  - An unspecified flaw exists in the Security: Privileges     subcomponent that allows an authenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-8286)

  - A flaw exists that is related to the use of temporary     files by REPAIR TABLE. An authenticated, remote attacker     can exploit this to gain elevated privileges.

  - A flaw exists in InnoDB when handling an operation that     dropped and created a full-text search table. An     authenticated, remote attacker can exploit this to     trigger an assertion, resulting in a denial of service     condition.

  - A flaw exists in InnoDB when accessing full-text     auxiliary tables while dropping the indexed table. An     authenticated, remote attacker can exploit this to     trigger an assertion, resulting in a denial of service     condition.

  - A buffer overflow condition exists when handling long     integer values in MEDIUMINT columns due to the improper     validation of certain input. An authenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.

  - An information disclosure vulnerability exists in the     validate_password plugin due to passwords that have been     rejected being written as plaintext to the error log. A     local attacker can exploit this to more easily guess     what passwords might have been chosen and accepted.

  - A flaw exists in InnoDB when handling an ALTER TABLE ...
    ENCRYPTION='Y', ALGORITHM=COPY operation that is applied     to a table in the system tablespace. An authenticated,     remote attacker can exploit this to trigger an     assertion, resulting in a denial of service condition.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
103008	EulerOS 2.0 SP2 : mariadb (EulerOS-SA-2017-1170)	Nessus	Huawei Local Security Checks	high
103007	EulerOS 2.0 SP1 : mariadb (EulerOS-SA-2017-1169)	Nessus	Huawei Local Security Checks	high
102755	CentOS 7 : mariadb (CESA-2017:2192)	Nessus	CentOS Local Security Checks	high
102648	Scientific Linux Security Update : mariadb on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	high
102299	Oracle Linux 7 : mariadb (ELSA-2017-2192)	Nessus	Oracle Linux Local Security Checks	high
102152	RHEL 7 : mariadb (RHSA-2017:2192)	Nessus	Red Hat Local Security Checks	high
96510	FreeBSD : MySQL -- multiple vulnerabilities (22373c43-d728-11e6-a9a5-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	high
94756	openSUSE Security Update : mysql-community-server (openSUSE-2016-1289)	Nessus	SuSE Local Security Checks	critical
94694	openSUSE Security Update : mysql-community-server (openSUSE-2016-1283)	Nessus	SuSE Local Security Checks	critical
94197	MySQL 5.6.x < 5.6.34 Multiple Vulnerabilities (October 2016 CPU) (SWEET32)	Nessus	Databases	critical
94196	MySQL 5.5.x < 5.5.53 Multiple Vulnerabilities (October 2016 CPU)	Nessus	Databases	critical
94166	MySQL 5.6.x < 5.6.34 Multiple Vulnerabilities (October 2016 CPU) (SWEET32)	Nessus	Databases	critical
94165	MySQL 5.5.x < 5.5.53 Multiple Vulnerabilities (October 2016 CPU)	Nessus	Databases	critical
9618	Oracle MySQL 5.7.x < 5.7.15 Multiple Vulnerabilities	Nessus Network Monitor	Database	high
9614	Oracle MySQL 5.6.x < 5.6.33 Multiple Vulnerabilities	Nessus Network Monitor	Database	high
9610	Oracle MySQL 5.5.x < 5.5.52 Multiple Vulnerabilities	Nessus Network Monitor	Database	high
93380	MySQL 5.7.x < 5.7.15 Multiple Vulnerabilities	Nessus	Databases	critical
93379	MySQL 5.7.x < 5.7.15 Multiple Vulnerabilities	Nessus	Databases	critical

Detections

Analytics

CVE-2016-5617

No Score

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

critical

critical

critical

critical

critical

critical

high

high

high

critical

critical