The version of MariaDB running on the remote host is 10.0.x prior to 10.0.24. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to impact     integrity and availability. (CVE-2016-0640)

  - An unspecified flaw exists in the MyISAM subcomponent     that allows an authenticated, remote attacker to     disclose sensitive information or cause a denial of     service condition. (CVE-2016-0641)

  - An unspecified flaw exists in the DDL subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0644)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0646)

  - An unspecified flaw exists in the PS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0649)

  - An unspecified flaw exists in the Replication     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-0650)

  - An unspecified flaw exists in the InnoDB subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0668)

  - A denial of service vulnerability exists in the     SELECT_LEX::update_used_tables() function in sql_lex.cc     due to improper handling of semi-join conditions on used     table updates. An authenticated, remote attacker can     exploit this to crash the database.

  - A denial of service vulnerability exists in the     JOIN::choose_subquery_plan() function in     opt_subselect.cc due to improper handling of nested IN     clauses that contain SQ. An authenticated, remote     attacker can exploit this to crash the database.

  - A denial of service vulnerability exists in the     select_create::prepare() function in sql_insert.cc due     to improper handling of stored procedures in new tables.
    An authenticated, remote attacker can exploit this to     crash the database.

  - A denial of service vulnerability exists in     sql_select.cc due to improper creation of keys in     temporary tables. An authenticated, remote attacker can     exploit this to crash the database.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

MariaDB 10.0.x < 10.0.24 Multiple Vulnerabilities

medium Nessus Plugin ID 93828

Version 1.10