Detections
Analytics

MariaDB Server 5.5.x < 5.5.51 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 9655

Synopsis

The remote database server is affected by multiple attack vectors.

Description

MariaDB is a community-developed fork of the MySQL relational database. The version of MariaDB installed on the remote host is 5.5.x earlier than 5.5.51, and is therefore affected by multiple vulnerabilities :

 - A denial of service vulnerability exists in the 'emb_stmt_execute()' function in file 'libmysqld/lib_sql.cc' when handling queries. An authenticated, remote attacker can exploit this to crash the database.
 - A flaw in the 'check_log_path()' function in 'sql/sys_vars.cc' that may allow an authenticated attacker with DBA permissions to gain elevated privileges. The issue is due to the program not properly restricting the ability to write to configuration files (e.g. my.cnf), combined with it loading a configuration file from specific locations that current versions do not use (e.g. '/var/lib/mysql/my.cnf'). This may allow an attacker to leverage specially crafted queries to use logging functionality to create new files or append custom content to existing files. By placing a custom '.cnf' file that MySQL will load, with a 'malloc_lib=' directive pointing to an attacker controlled 'mysql_hookandroot_lib.so' file, the attacker can cause MySQL to read the configuration file and load the malicious library the next time it starts. This can allow the attacker to gain root privileges.
 - A denial of service vulnerability exists in the 'st_select_lex_unit::cleanup()' function within file 'sql/sql_union.cc' when handling 'UNION' queries during 'JOIN' cleanup. An authenticated, remote attacker can exploit this to crash the database.

Solution

Upgrade to version 5.5.51 or later.

See Also

https://mariadb.com/kb/en/mariadb/mariadb-5551-release-notes

Plugin Details

Severity: High

ID: 9655

Family: Database

Published: 10/7/2016

Updated: 3/6/2019

Nessus ID: 93611

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:X

Vulnerability Information

CPE: cpe:/a:mariadb:mariadb

Patch Publication Date: 9/13/2016

Vulnerability Publication Date: 9/23/2015

Reference Information

CVE: CVE-2016-6662

BID: 92912