With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an ability to run code on the server machine to intercept the named pipe connection and act as a man-in-the-middle, gaining access to all the data passed between the client and the server, and getting the ability to run SQL commands on behalf of the connected user. This occurs because of an incorrect security descriptor. This affects MariaDB Server before 10.1.48, 10.2.x before 10.2.35, 10.3.x before 10.3.26, 10.4.x before 10.4.16, and 10.5.x before 10.5.7. NOTE: this issue exists because certain details of the MariaDB CVE-2019-2503 fix did not comprehensively address attack variants against MariaDB. This situation is specific to MariaDB, and thus CVE-2020-28912 does NOT apply to other vendors that were originally affected by CVE-2019-2503.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions
    that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable
    vulnerability allows low privileged attacker with network access via multiple protocols to compromise
    MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang
    or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14765)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are
    affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high
    privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful
    attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable
    crash (complete DOS) of MySQL Server. (CVE-2020-14776)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions
    that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high
    privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful
    attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable
    crash (complete DOS) of MySQL Server. (CVE-2020-14789)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions
    that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable
    vulnerability allows high privileged attacker with network access via multiple protocols to compromise
    MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang
    or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14812)

  - With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible
    for an unprivileged user with an ability to run code on the server machine to intercept the named pipe
    connection and act as a man-in-the-middle, gaining access to all the data passed between the client and
    the server, and getting the ability to run SQL commands on behalf of the connected user. This occurs
    because of an incorrect security descriptor. This affects MariaDB Server before 10.1.48, 10.2.x before
    10.2.35, 10.3.x before 10.3.26, 10.4.x before 10.4.16, and 10.5.x before 10.5.7. NOTE: this issue exists
    because certain details of the MariaDB CVE-2019-2503 fix did not comprehensively address attack variants
    against MariaDB. This situation is specific to MariaDB, and thus CVE-2020-28912 does NOT apply to other
    vendors that were originally affected by CVE-2019-2503. (CVE-2020-28912)

The version of MariaDB installed on the remote host is prior to 10.5.7. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.5.7 advisory.

  - With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible     for an unprivileged user with an ability to run code on the server machine to intercept the named pipe     connection and act as a man-in-the-middle, gaining access to all the data passed between the client and     the server, and getting the ability to run SQL commands on behalf of the connected user. This occurs     because of an incorrect security descriptor. This affects MariaDB Server before 10.1.48, 10.2.x before     10.2.35, 10.3.x before 10.3.26, 10.4.x before 10.4.16, and 10.5.x before 10.5.7. NOTE: this issue exists     because certain details of the MariaDB CVE-2019-2503 fix did not comprehensively address attack variants     against MariaDB. This situation is specific to MariaDB, and thus CVE-2020-28912 does NOT apply to other     vendors that were originally affected by CVE-2019-2503. (CVE-2020-28912)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions     that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14765)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are     affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2020-14776)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions     that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2020-14789)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions     that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable     vulnerability allows high privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14812)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 10.2.35. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.2.35 advisory.

  - With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible     for an unprivileged user with an ability to run code on the server machine to intercept the named pipe     connection and act as a man-in-the-middle, gaining access to all the data passed between the client and     the server, and getting the ability to run SQL commands on behalf of the connected user. This occurs     because of an incorrect security descriptor. This affects MariaDB Server before 10.1.48, 10.2.x before     10.2.35, 10.3.x before 10.3.26, 10.4.x before 10.4.16, and 10.5.x before 10.5.7. NOTE: this issue exists     because certain details of the MariaDB CVE-2019-2503 fix did not comprehensively address attack variants     against MariaDB. This situation is specific to MariaDB, and thus CVE-2020-28912 does NOT apply to other     vendors that were originally affected by CVE-2019-2503. (CVE-2020-28912)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions     that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14765)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are     affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2020-14776)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions     that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2020-14789)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions     that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable     vulnerability allows high privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14812)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 10.1.48. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.1.48 advisory.

  - With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible     for an unprivileged user with an ability to run code on the server machine to intercept the named pipe     connection and act as a man-in-the-middle, gaining access to all the data passed between the client and     the server, and getting the ability to run SQL commands on behalf of the connected user. This occurs     because of an incorrect security descriptor. This affects MariaDB Server before 10.1.48, 10.2.x before     10.2.35, 10.3.x before 10.3.26, 10.4.x before 10.4.16, and 10.5.x before 10.5.7. NOTE: this issue exists     because certain details of the MariaDB CVE-2019-2503 fix did not comprehensively address attack variants     against MariaDB. This situation is specific to MariaDB, and thus CVE-2020-28912 does NOT apply to other     vendors that were originally affected by CVE-2019-2503. (CVE-2020-28912)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions     that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14765)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions     that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable     vulnerability allows high privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14812)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 10.4.16. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.4.16 advisory.

  - With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible     for an unprivileged user with an ability to run code on the server machine to intercept the named pipe     connection and act as a man-in-the-middle, gaining access to all the data passed between the client and     the server, and getting the ability to run SQL commands on behalf of the connected user. This occurs     because of an incorrect security descriptor. This affects MariaDB Server before 10.1.48, 10.2.x before     10.2.35, 10.3.x before 10.3.26, 10.4.x before 10.4.16, and 10.5.x before 10.5.7. NOTE: this issue exists     because certain details of the MariaDB CVE-2019-2503 fix did not comprehensively address attack variants     against MariaDB. This situation is specific to MariaDB, and thus CVE-2020-28912 does NOT apply to other     vendors that were originally affected by CVE-2019-2503. (CVE-2020-28912)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions     that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14765)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are     affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2020-14776)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions     that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2020-14789)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions     that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable     vulnerability allows high privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14812)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 10.3.26. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.3.26 advisory.

  - With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible     for an unprivileged user with an ability to run code on the server machine to intercept the named pipe     connection and act as a man-in-the-middle, gaining access to all the data passed between the client and     the server, and getting the ability to run SQL commands on behalf of the connected user. This occurs     because of an incorrect security descriptor. This affects MariaDB Server before 10.1.48, 10.2.x before     10.2.35, 10.3.x before 10.3.26, 10.4.x before 10.4.16, and 10.5.x before 10.5.7. NOTE: this issue exists     because certain details of the MariaDB CVE-2019-2503 fix did not comprehensively address attack variants     against MariaDB. This situation is specific to MariaDB, and thus CVE-2020-28912 does NOT apply to other     vendors that were originally affected by CVE-2019-2503. (CVE-2020-28912)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions     that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14765)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are     affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2020-14776)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions     that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2020-14789)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions     that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable     vulnerability allows high privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14812)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
405521	Alpine: mariadb: security update to 10.3.27-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405521	Alpine: mariadb: security update to 10.3.27-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
142221	MariaDB 10.5.0 < 10.5.7 Multiple Vulnerabilities	Nessus	Databases	high
142220	MariaDB 10.2.0 < 10.2.35 Multiple Vulnerabilities	Nessus	Databases	high
142219	MariaDB 10.1.0 < 10.1.48 Multiple Vulnerabilities	Nessus	Databases	high
142217	MariaDB 10.4.0 < 10.4.16 Multiple Vulnerabilities	Nessus	Databases	high
142216	MariaDB 10.3.0 < 10.3.26 Multiple Vulnerabilities	Nessus	Databases	high

Detections

Analytics

CVE-2020-28912

high

Tenable Plugins

high

high

high

high

high

high

high