The version of MariaDB running on the remote host is 10.0.x prior to 10.0.27. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the check_log_path() function within     file sql/sys_vars.cc due to inadequate restrictions on     the ability to write to the my.cnf configuration file     and allowing the loading of configuration files from     path locations not used by current versions. An     authenticated, remote attacker can exploit this issue     by using specially crafted queries that utilize logging     functionality to create new files or append custom     content to existing files. This allows the attacker to     gain root privileges by inserting a custom .cnf file     with a 'malloc_lib=' directive pointing to specially     crafted mysql_hookandroot_lib.so file and thereby cause     MySQL to load a malicious library the next time it is     started. (CVE-2016-6662)

  - A denial of service vulnerability exists in the     emb_stmt_execute() function in file libmysqld/lib_sql.cc     when handling queries. An authenticated, remote attacker     can exploit this to crash the database.

  - A NULL pointer dereference flaw exists in the     innobase_need_rebuild() function when handling renamed     columns that allows an authenticated, remote attacker to     crash the database, resulting in a denial of service.

  - A denial of service vulnerability exists in the     ha_myisam::enable_indexes() function within file     storage/myisam/ha_myisam.cc when handling ALTER TABLE     statements. An authenticated, remote attacker can     exploit this to crash the database.

  - A denial of service vulnerability exists in the     Item_sum_std::val_real() function within file     sql/item_sum.cc when handling SUM statements. An     authenticated, remote attacker exploit this to crash the     database.

  - A denial of service vulnerability exists in the     my_double_round() function within file sql/item_func.cc     when handling specially crafted queries. An     authenticated, remote attacker can exploit this to crash     the database.

  - A denial of service vulnerability exists in the     st_select_lex_unit::cleanup() function within file     sql/sql_union.cc when handling UNION queries during JOIN     cleanup. An authenticated, remote attacker can exploit     this to crash the database.

Detections

Analytics

MariaDB 10.0.x < 10.0.27 Multiple Vulnerabilities

critical Nessus Plugin ID 93609

Version 1.12