The remote web server is running the Sybase SQL-Anywhere database server with default credentials.  That is, the Sybase SQL Anywhere server ships with the default administrative credentials of 'dba/sql'.  The NNM has just observed a user logging in using those credentials. 

The remote web server is running a Sybase SQL-Anywhere database client.

The remote server is running the Sybase SQL-Anywhere database server.

The remote web server is running a MySQL database client

The remote server is running the MySQL database server.

According to its version, the installation of IBM DB2 9.1 / 9.5 on the remote host is affected by one or more of the following vulnerabilities : 

  - A denial-of-service issue when the application processes crafted IPv6 addresses in the correlation token. (IZ38874)
  - A security-bypass issue exists in the application when LDAP-based authentication is used. (LI73778)

According to its version, the installed version of IBM DB2 server is older than 9.1 Fix Pack 7. Such versions are reportedly affected by an information disclosure vulnerability. Specifically, in certain situations an INNER JOIN predicate is applied before the OUTER JOIN  predicate, which could result in disclosure of sensitive information.  (JR31886).

The version of MySQL 6.0 installed on the remote host is earlier than 6.0.10 and thus affected by a denial of service vulnerability. Specifically, a user can cause an assertion failure leading to a server crash by calling 'ExtractValue()' or 'UpdateXML()' using an XPath expression employing a scalar expression as a 'FilterExpr'.

The remote host seems to be running a Firebird database server.

This version of Firebird is vulnerable to a number of flaws.  While the details of the flaws are currently unknown, the vendor has addressed the issues.  It is believed that an attacker exploiting these flaws would be able to gain access to confidential data and/or cause the database to crash. 

According to its version, the installation of IBM DB2 on the remote host is affected by one or more of the following vulnerabilities : 

  - There is an unspecified security vulnerability related to a 'DB2FMP' process (IZ20352).
  - There is an unspecified security vulnerability in a CLR-stored procedure deployment from IBM Database Add-Ins for Visual Studio (JR28432).
  - The password used to connect to the database can be seen in plaintext in a memory dump (JR27422).
  - There is a possible stack variable overrun in 'SQLRLAKA()' (IZ16346).
  - A local privilege escalation vulnerability via file creation can result in root-level access (IZ12735).
  - There are possible buffer overflows involving 'XQUERY',  'XMLQUERY', 'XMLEXISTS', and 'XMLTABLE' (IZ18434).

The remote host is running an Interbase database server.

This version has been reported vulnerable to a remote buffer overflow.  An attacker, exploiting this flaw, would only need to be able to connect to the database service port (3050/tcp by default).  Successful exploitation would result in the attacker executing arbitrary code.

The remote host is running an Interbase database server.

The remote host is running an Interbase or Firebird database server.

The version of Firebird on the remote host uses default credentials to control access.  Knowing these, an attacker can gain administrative access to the affected application.

According to its version number, the installation of MySQL on the remote host may be prone to multiple buffer overflows.  The MySQL server is also vulnerable to multiple information disclosure flaws.  An attacker exploiting the overflow would need to be able to authenticate to the MySQL server.  An attacker exploiting the information disclosure flaw would only need to be able to send malformed 'login' packets to the server. This version of MySQL is also prone to a remote Denial of Service (DoS) due to an inability to properly parse a malformed call to the date_format function.

The remote host is running a version of MySQL that is older than version 3.23.49 or than 4.0.20.  The version of the utility Mysqlhotcopy included in these versions of MySQL is reported to be prone to a vulnerability that may permit an attacker to overwrite arbitrary files on the database server with the privilege of the targeted user. Privilege escalation may also be possible. An attacker requires local interactive access in order to exploit this vulnerability. 

The remote host appears to be running the Firebird database server.  You should manually inspect the system to ensure that the database is at least version 1.5.0

NNM has observed the remote host running Microsoft SQL Server Database Instances.

ID	Name	Severity
5150	Sybase SQL-Anywhere Database Server Default Credentials	high
5149	Sybase SQL-Anywhere Database Client Detection	info
5148	Sybase SQL-Anywhere Database Server Detection	info
5136	MySQL Database Client Detection	info
5135	Oracle MySQL Database Server Detection	info
5129	Microsoft SQL Client Detection	info
5119	IBM DB2 Client Detection	info
5043	IBM DB2 9.1 < 9.1 Fix Pack 7 / 9.5 < 9.5 Fix Pack 4 Multiple Vulnerabilities	medium
5006	IBM DB2 9.1 < 9.1 Fix Pack 7 Information Disclosure	medium
5002	Oracle MySQL 6.0 < 6.0.10 XPath Expression DoS	medium
4584	Firebird Database < 2.1.1.17910 Multiple Vulnerabilities	medium
4536	IBM DB2 9.x < 9 Fix Pack 5 Multiple Vulnerabilities	critical
4514	Interbase Database Remote Stack Overflow	critical
4513	Interbase Database Version Detection	info
4512	Interbase/Firebird Account Detection	info
4511	Firebird Default Credentials	high
3527	Oracle MySQL Remote Overflow and Information Disclosure Vulnerabilities	medium
2131	SQL Server Detection	info
2129	Oracle MySQL Mysqlhotcopy Script Insecure Temporary File Creation	high
2000	Firebird Database Detection	info
7220	Microsoft SQL Server Database Instance Detection	info

Detections

Analytics

Database Family for Nessus Network Monitor

high

info

info

info

info

info

info

medium

medium

medium

medium

critical

critical

info

info

high

medium

info

high

info

info