Detections
Analytics

RHEL 7 : mariadb (RHSA-2015:1665) (BACKRONYM)

medium Nessus Plugin ID 85616

Language:

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

Updated mariadb packages that fix several security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

It was found that the MySQL client library permitted but did not require a client to use SSL/TLS when establishing a secure connection to a MySQL server using the '--ssl' option. A man-in-the-middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server. (CVE-2015-3152)

This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
(CVE-2015-0501, CVE-2015-2568, CVE-2015-0499, CVE-2015-2571, CVE-2015-0433, CVE-2015-0441, CVE-2015-0505, CVE-2015-2573, CVE-2015-2582, CVE-2015-2620, CVE-2015-2643, CVE-2015-2648, CVE-2015-4737, CVE-2015-4752, CVE-2015-4757)

These updated packages upgrade MariaDB to version 5.5.44. Refer to the MariaDB Release Notes listed in the References section for a complete list of changes.

All MariaDB users should upgrade to these updated packages, which correct these issues. After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.

Solution

Update the affected packages.

See Also

http://www.nessus.org/u?ef68d9ef

http://www.nessus.org/u?73eb3b44

https://mariadb.com/kb/en/library/mariadb-5544-release-notes/

https://access.redhat.com/errata/RHSA-2015:1665

https://access.redhat.com/security/cve/cve-2015-0433

https://access.redhat.com/security/cve/cve-2015-0441

https://access.redhat.com/security/cve/cve-2015-0499

https://access.redhat.com/security/cve/cve-2015-0501

https://access.redhat.com/security/cve/cve-2015-0505

https://access.redhat.com/security/cve/cve-2015-2568

https://access.redhat.com/security/cve/cve-2015-2571

https://access.redhat.com/security/cve/cve-2015-2573

https://access.redhat.com/security/cve/cve-2015-2582

https://access.redhat.com/security/cve/cve-2015-2620

https://access.redhat.com/security/cve/cve-2015-2643

https://access.redhat.com/security/cve/cve-2015-2648

https://access.redhat.com/security/cve/cve-2015-3152

https://access.redhat.com/security/cve/cve-2015-4737

https://access.redhat.com/security/cve/cve-2015-4752

https://access.redhat.com/security/cve/cve-2015-4757

https://access.redhat.com/security/cve/cve-2015-4864

Plugin Details

Severity: Medium

ID: 85616

File Name: redhat-RHSA-2015-1665.nasl

Version: 2.20

Type: local

Agent: unix

Published: 8/25/2015

Updated: 10/24/2019

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.7

CVSS v2

Risk Factor: Medium

Base Score: 5.7

Temporal Score: 4.2

Vector: CVSS2#AV:N/AC:M/Au:M/C:N/I:N/A:C

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:mariadb-embedded, cpe:/o:redhat:enterprise_linux:7, cpe:/o:redhat:enterprise_linux:7.3, p-cpe:/a:redhat:enterprise_linux:mariadb-devel, cpe:/o:redhat:enterprise_linux:7.4, p-cpe:/a:redhat:enterprise_linux:mariadb-debuginfo, p-cpe:/a:redhat:enterprise_linux:mariadb, p-cpe:/a:redhat:enterprise_linux:mariadb-bench, cpe:/o:redhat:enterprise_linux:7.5, cpe:/o:redhat:enterprise_linux:7.6, p-cpe:/a:redhat:enterprise_linux:mariadb-test, cpe:/o:redhat:enterprise_linux:7.7, p-cpe:/a:redhat:enterprise_linux:mariadb-embedded-devel, cpe:/o:redhat:enterprise_linux:7.2, p-cpe:/a:redhat:enterprise_linux:mariadb-server, cpe:/o:redhat:enterprise_linux:7.1, p-cpe:/a:redhat:enterprise_linux:mariadb-libs

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 8/24/2015

Vulnerability Publication Date: 4/16/2015

Reference Information

CVE: CVE-2015-0433, CVE-2015-0441, CVE-2015-0499, CVE-2015-0501, CVE-2015-0505, CVE-2015-2568, CVE-2015-2571, CVE-2015-2573, CVE-2015-2582, CVE-2015-2620, CVE-2015-2643, CVE-2015-2648, CVE-2015-3152, CVE-2015-4737, CVE-2015-4752, CVE-2015-4757, CVE-2015-4864

RHSA: 2015:1665