MariaDB Server 10.0.x < 10.0.27 Multiple DoS

high Nessus Network Monitor Plugin ID 9544

Synopsis

The remote database server is affected by multiple Denial of Service (DoS) attack vectors.

Description

MariaDB is a community-developed fork of the MySQL relational database. The version of MariaDB installed on the remote host is 10.0.x prior to 10.0.27, and is therefore affected by multiple DoS vulnerabilities :

 - A flaw exists in the 'emb_stmt_execute()' function in 'libmysqld/lib_sql.cc' that is triggered during the handling of queries. This may allow an authenticated attacker to crash the database.
 - A NULL pointer dereference flaw exists in the 'innobase_need_rebuild()' function that is triggered during the handling of renamed columns. This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'ha_myisam::enable_indexes()' function in 'storage/myisam/ha_myisam.cc' that is triggered during the handling of ALTER TABLE statements. This may allow an authenticated attacker to crash the database.
 - An unspecified flaw exists in the 'check_log_path()' function in 'sql/sys_vars.cc' that may allow an authenticated attacker to have an unspecified impact related to the 'general_log_file'. No further details have been provided.
 - A flaw exists in the 'Item_sum_std::val_real()' function in 'sql/item_sum.cc' that is triggered during the handling of SUM statements. This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'my_double_round()' function in 'sql/item_func.cc' that is triggered during the handling of specially crafted queries. This may allow an authenticated attacker to crash the database.
 - A denial of service vulnerability exists in the 'st_select_lex_unit::cleanup()' function within file 'sql/sql_union.cc' when handling 'UNION' queries during 'JOIN' cleanup. An authenticated, remote attacker can exploit this to crash the database.

Solution

Upgrade to version 10.0.27 or later.

See Also

https://jira.mariadb.org/browse/MDEV-10465

https://mariadb.com/kb/en/mariadb-10027-changelog

Plugin Details

Severity: High

ID: 9544

Family: Database

Published: 9/2/2016

Updated: 3/6/2019

Dependencies: 8693

Nessus ID: 93609

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 9

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

CVSS v3.0

Base Score: 8.8

Temporal Score: 8.4

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*

Patch Publication Date: 8/25/2016

Vulnerability Publication Date: 7/31/2016

Reference Information

CVE: CVE-2016-6662

BID: 92912