远程 Redhat Enterprise Linux 6 / 7 主机上安装的程序包受到 RHSA-2016:2928 公告中提及的多个漏洞影响。

    MariaDB 是一款多用户、多线程 SQL 数据库服务器。出于所有实用目的，MariaDB 与 MySQL 二进制兼容。

    下列程序包已升级到更新的上游版本：rh-mariadb101-mariadb (10.1.19)。

    安全修复：

    * 已发现 MariaDB 登录功能允许写入 MariaDB 配置文件。
    管理数据库用户，或具有 FILE 权限的数据库用户，可能会利用此缺陷，在运行数据库服务器的系统上利用根权限运行任意命令。(CVE-2016-6662)

    * 在 MariaDB 执行 MyISAM 引擎表修复的方式中发现争用条件。对运行 mysqld 的服务器具有 shell 访问权限的数据库用户可利用此缺陷更改 mysql 系统用户可写入的任意文件的权限。（CVE-2016-6663、CVE-2016-5616）

    * 此更新修复了 MariaDB 数据库服务器中的多个漏洞。有关这些缺陷的信息，请参阅“参考”部分中列出的“Oracle 关键修补程序更新公告”页面。
    （CVE-2016-3492、CVE-2016-5624、CVE-2016-5626、CVE-2016-5629、CVE-2016-8283）

Tenable 已直接从 Red Hat Enterprise Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

現已提供適用於 Slackware 14.1、14.2 和最新版本的新 mariadb 套件，可修正數個安全性問題。

遠端主機上安裝的 MariaDB 版本比 5.5.52 舊。因此會受到 mariadb-5552-release-notes 公告中所提及的多個弱點影響。

  - 5.5.52之前的 5.6.x 、 5.6.33之前的 5.7.x 及 [ 5.7.15] 之前的 以及 8.x 之前的 8.0.1中的爭用情形 5.5.52之前的 MariaDB、 10.0.x 之前的 10.0.28和 10.1.x 之前的 10.1.18Percona Server 5.5.51-38.2之前的版本、 5.6.x 5.6.32-78-1 之前的 版與 5.7.x5.7.14-8] 之前的 版 5.5.41-37.0之前的 [] 、 [ 5.6.32-25.17之前的  5.6.x 和 5.7.x 之前的 5.7.14-26.17 和 Percona XtraDB Cluster 允許具有特定權限的本機使用者利用 REPAIR TABLE 對 my_copystat 的使用來修復 MyISAM 表格從而取得權限。
    (CVE-2016-6663)

  - 拒絕原因：請勿使用此候選版本編號。ConsultID：CVE-2016-6663。原因：此候選編號是 CVE-2016-6663 的保留複本。注意：所有 CVE 使用者都應該參照 CVE-2016-6663 而非此候選編號。已移除此候選版本中的所有參照和描述，以防止意外使用 (CVE-2016-5616)

  - Oracle MySQL 5.5.51 與先前的版本、 5.6.32 與先前的版本以及 [] 與先前的版本以及 5.7.14 與先前的版本允許經驗證的遠端使用者透過與 Server: Optimizer 相關的向量影響可用性。
    (CVE-2016-3492)

  - 在 和更舊版本的 Oracle MySQL 5.5.51 中存在一個不明弱點允許經驗證的遠端使用者透過與 DML 有關的向量影響可用性。 (CVE-2016-5624)

  - Oracle MySQL 5.5.51 與先前的版本、 5.6.32 與先前的版本以及 [] 與先前的版本以及 5.7.14 與先前的版本允許經驗證的遠端使用者透過與 GIS 相關的向量影響可用性。 (CVE-2016-5626)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端主機上安裝的 MySQL 5.7.x 版比 5.7.15 舊。因此，會受到多個弱點影響：

- 檔案 sql/sys_vars.cc 內的 check_log_path() 函式中存在一個瑕疵，這是因為對於寫入至 my.cnf 組態檔案的能力限制不充分所導致，其允許從非由目前版本使用的路徑位置載入組態檔案。經驗證的遠端攻擊者可惡意利用此問題，透過使用特製的查詢，利用記錄功能來建立新檔案或將自訂內容附加至現有檔案。這允許攻擊者插入使「malloc_lib=」指示詞指向特製 mysql_hookandroot_lib.so 檔案的自訂 .cnf 檔案，進而造成 MySQL 在下次啟動時載入惡意程式庫，來取得 root 權限。(CVE-2016-6662)

- 存在一個不明瑕疵，其允許經驗證的遠端攻擊者繞過限制，並在無檔案權限需求的情況下建立含有自訂內容的 /var/lib/mysql/my.cnf 檔案。(CVE-2016-6663) 
 - 存在一個與 REPAIR TABLE 使用暫存檔有關的瑕疵。經驗證的遠端攻擊者可惡意利用此瑕疵來取得提升的權限。
 (VulnDB 143808)

- 處理放置並建立了一個全文檢索搜尋表格的作業時，InnoDB 中存在一個瑕疵。未經驗證的遠端攻擊者可利用此問題觸發宣告，進而導致拒絕服務情形。(VulnDB 143820)

- 在放置已編製索引的表格期間，同時存取全文檢索輔助表格時，InnoDB 中存在一個瑕疵。未經驗證的遠端攻擊者可利用此問題觸發宣告，進而導致拒絕服務情形。(VulnDB 143821)

- 由於不當驗證特定輸入，導致處理 MEDIUMINT 欄中的長整數值時，存在一個緩衝區溢位情形。經驗證的遠端攻擊者可惡意利用此瑕疵，造成拒絕服務情形或執行任意程式碼。
 (VulnDB 143822)

- validate_password 外掛程式中存在一個資訊洩漏弱點，此弱點是因系統將已遭拒絕的密碼以純文字形式寫入錯誤記錄中所導致。本機攻擊者可惡意利用此弱點，更輕易猜出可能已被選擇和接受的密碼。
 (VulnDB 143824)

- 處理套用至系統表格空間中某個表格的 ALTER TABLE ...
 ENCRYPTION='Y', ALGORITHM=COPY 作業時，InnoDB 中存在一個瑕疵。未經驗證的遠端攻擊者可利用此問題觸發宣告，進而導致拒絕服務情形。
 (VulnDB 143826)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

遠端 Redhat Enterprise Linux 6/7 主機上安裝的套件受到 RHSA-2016:2928 公告中提及的多個弱點影響。

    MariaDB 是多使用者、多執行緒的 SQL 資料庫伺服器。實際上，MariaDB 與 MySQL 二進位相容。

    下列套件已升級至更新的上游版本：rh-mariadb101-mariadb (10.1.19)。

    安全性修正：

    * 據發現，MariaDB 記錄功能會允許寫入至 MariaDB 組態檔案的動作。
    資料庫管理員使用者或具有 FILE 權限的資料庫使用者可利用此缺陷，在執行資料庫伺服器的系統上以 root 權限執行任意命令。(CVE-2016-6662)

    * 在 MariaDB 執行 MyISAM 引擎表格修正的方式中，發現爭用情形。對執行 mysqld 的伺服器具有殼層存取權限的資料庫使用者可利用此缺陷，變更 mysql 系統使用者可寫入的任意檔案權限。(CVE-2016-6663、CVE-2016-5616)

    * 此更新可修正 MariaDB 資料庫伺服器中的數個弱點。有關這些缺陷的詳細資訊，請參閱「Oracle 重要修補程式更新公告」頁面的〈參照〉一節內容。
    (CVE-2016-3492、CVE-2016-5624、CVE-2016-5626、CVE-2016-5629、CVE-2016-8283)

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端主機上執行的 MySQL 版本是 5.5.53 之前的 5.5.x 版。因此，該應用程式受到多個弱點影響：

  - Optimizer 子元件中存在一個不明缺陷，會允許經驗證的遠端攻擊者造成拒絕服務情形。(CVE-2016-3492)

  - Security: Encryption 子元件中存在一個不明缺陷，經驗證的遠端攻擊者可藉以洩漏敏感資訊。
    (CVE-2016-5584)

  - MyISAM 子元件中存在一個不明缺陷，本機攻擊者可藉以取得提升的權限。(CVE-2016-5616)

  - Error Handling 子元件中存在一個不明缺陷，本機攻擊者可藉以取得提升的權限。(CVE-2016-5617)

  - GIS 子元件中存在一個不明缺陷，經驗證的遠端攻擊者可藉以造成拒絕服務情形。(CVE-2016-5626)

  - Federated 子元件中存在一個不明缺陷，經驗證的遠端攻擊者可藉以造成拒絕服務情形。(CVE-2016-5629)

  - 檔案 sql/sys_vars.cc 內的 check_log_path() 函式中存在一個瑕疵，這是因為對於寫入至 my.cnf 設定檔案的能力限制不充分所導致，其允許從非由目前版本使用的路徑位置載入設定檔案。經驗證的遠端攻擊者可惡意利用此問題，透過使用特製的查詢，利用記錄功能來建立新檔案或將自訂內容附加至現有檔案。這允許攻擊者插入使「malloc_lib=」指示詞指向特別建構的 mysql_hookandroot_lib.so 檔案的自訂 .cnf 檔案，進而造成 MySQL 在下次啟動時載入惡意程式庫，來取得 root 權限。(CVE-2016-6662)

  - wolfSSL 中存在缺陷，尤其是在 AES 加密和解密的 C 軟體版本中，這是表格查詢未正確考量快取記憶庫存取時間所致。本機攻擊者可加以惡意利用，透過特製的應用程式洩漏 AES 金鑰。
    (CVE-2016-7440)

  - Types 子元件中存在一個不明缺陷，會允許經驗證的遠端攻擊者造成拒絕服務情形。(CVE-2016-8283)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

來自 Red Hat 安全公告 2016:2595： 現已提供適用於 Red Hat Enterprise Linux 7 的 mariadb 更新。 Red Hat 產品安全性團隊已將此更新評等為具有重要安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。 MariaDB 是與 MySQL 二進位相容的多使用者、多執行緒 SQL 資料庫伺服器。 下列套件已升級到更新的上游版本： mariadb (5.5.52)。(BZ#1304516, BZ#1377974) 安全性修正： * 據發現，MariaDB 記錄功能會允許寫入至 MariaDB 組態檔案的動作。資料庫管理員使用者或具有 FILE 權限的資料庫使用者可利用此缺陷，在執行資料庫伺服器的系統上以 root 權限執行任意命令。(CVE-2016-6662) * 在 MariaDB 執行 MyISAM 引擎表格修正的方式中，發現爭用情形。對執行 mysqld 的伺服器具有殼層存取權限的資料庫使用者可利用此缺陷，變更 mysql 系統使用者可寫入的任意檔案權限。(CVE-2016-6663) * 此更新可修正 MariaDB 資料庫伺服器中的數個弱點。有關這些缺陷的詳細資訊，請參閱「Oracle 重要修補程式更新公告」頁面的〈參照〉一節內容。 (CVE-2016-3492, CVE-2016-5612, CVE-2016-5616, CVE-2016-5624, CVE-2016-5626, CVE-2016-5629, CVE-2016-8283) 其他變更： 如需有關此發行版本的詳細變更資訊，請參閱可從「參照」一節連結的 Red Hat Enterprise Linux 7.3 版本資訊。

下列套件已升級至更新的上游版本： mariadb (5.5.52)。安全性修正：- 據發現，MariaDB 記錄功能會允許寫入至 MariaDB 組態檔案的動作。資料庫管理員使用者或具有 FILE 權限的資料庫使用者可利用此缺陷，在執行資料庫伺服器的系統上以 root 權限執行任意命令。(CVE-2016-6662) - 在 MariaDB 執行 MyISAM 引擎表格修復的方式中，發現爭用情形。對執行 mysqld 的伺服器具有殼層存取權限的資料庫使用者可利用此缺陷，變更 mysql 系統使用者可寫入的任意檔案權限。(CVE-2016-6663) (CVE-2016-3492、CVE-2016-5612、CVE-2016-5616、CVE-2016-5624、CVE-2016-5626、CVE-2016-5629、CVE-2016-8283) 其他變更：

The version of MySQL installed on the remote host is version 5.5.x prior to 5.5.52 and is affected by multiple issues :

 - A flaw exists related to the way 'REPAIR TABLE' uses temporary files.  This may allow an authenticated attacker to gain elevated privileges.
 - An overflow condition exists that is triggered as certain input is not properly validated when handling long integer values in 'MEDIUMINT' columns.  This may allow an authenticated attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A flaw exists that is triggered during the handling of prepared statements that use a parameter in the select list of a derived table that was part of a join.  This may allow an authenticated attacker to crash the server.
 - An unspecified flaw exists related to the Error Handling subcomponent. This may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the MyISAM subcomponent. This may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the DML subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the GIS subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Optimizer subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Federated subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Types subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.

The version of MariaDB installed on the remote host is 10.0.x prior to 10.0.28, and is affected by multiple vulnerabilities :

 - An unspecified flaw may allow an authenticated attacker to bypass restrictions and create the '/var/lib/mysql/my.cnf' file with custom contents without the FILE privilege requirement.
 - A flaw in the C software version of AES Encryption and Decryption is triggered as table lookups do not properly consider cache-bank access times. This may allow a local user to disclose AES keys via a specially crafted application.
 - An unspecified flaw exists related to the MyISAM subcomponent. This may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the DML subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the GIS subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Optimizer subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Federated subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Security: Encryption subcomponent. This may allow an authenticated remote attacker to disclose potentially sensitive information. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Types subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - A flaw exists in the 'fill_alter_inplace_info()' function in 'sql/sql_table.cc' that is triggered when altering persistent virtual columns. This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'mysql_rm_table_no_locks()' function in 'sql/sql_table.cc' that is triggered during the handling of 'CREATE OR REPLACE TABLE' queries. This may allow an authenticated attacker to crash the database.
 - A flaw exists in 'scripts/mysqld_safe.sh' that is triggered when handling arguments to 'malloc-lib'.  This may allow a local attacker to potentially gain elevated privileges.  Note that CVE-2016-6664 is reportedly a duplicate assignment of CVE-2016-5617, which was assigned to this issue's manifestation in Oracle MySQL.

The version of MySQL installed on the remote host is version 5.6.x prior to 5.6.33 and is affected by multiple issues :

 - A flaw exists related to the way 'REPAIR TABLE' uses temporary files.  This may allow an authenticated attacker to gain elevated privileges.
 - A flaw exists in InnoDB that is triggered during the handling of an operation that dropped and created a full-text search table. This may allow an authenticated attacker to trigger an assertion and cause a denial of service.
 - A flaw exists in InnoDB that is triggered when accessing full-text search auxiliary tables while dropping the indexed table.  This may allow an authenticated attacker to trigger an assertion and cause a denial of service.
 - An overflow condition exists that is triggered as certain input is not properly validated when handling long integer values in 'MEDIUMINT' columns.  This may allow an authenticated attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A flaw exists that is triggered during the handling of prepared statements that use a parameter in the select list of a derived table that was part of a join.  This may allow an authenticated attacker to crash the server.
 - An unspecified flaw exists related to the Error Handling subcomponent. This may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the MyISAM subcomponent. This may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the GIS subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Optimizer subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Federated subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the InnoDB subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Types subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.

The version of MySQL installed on the remote host is version 5.7.x prior to 5.7.15 and is affected by multiple issues :

 - A flaw exists related to the way 'REPAIR TABLE' uses temporary files.  This may allow an authenticated attacker to gain elevated privileges.
 - A flaw exists in InnoDB that is triggered during the handling of an operation that dropped and created a full-text search table.  This may allow an authenticated attacker to trigger an assertion and cause a denial of service.
 - A flaw exists in InnoDB that is triggered when accessing full-text search auxiliary tables while dropping the indexed table.  This may allow an authenticated attacker to trigger an assertion and cause a denial of service.
 - An overflow condition exists that is triggered as certain input is not properly validated when handling long integer values in 'MEDIUMINT' columns.  This may allow an authenticated attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A flaw exists in the 'validate_password' plugin that is triggered as rejected passwords are logged in plaintext on the error log.  This may allow a local attacker to gain access to passwords that did not meet the password policy, but may potentially be very close to the password ultimately chosen and accepted.
 - A flaw exists in InnoDB that is triggered during the handling of an 'ALTER TABLE ... ENCRYPTION=Y, ALGORITHM=COPY' operation on a table residing in the system tablespace.  This may allow an authenticated attacker to crash the server.
 - An unspecified flaw exists related to the Optimizer subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. (CVE-2016-3492)
 - An unspecified flaw exists related to the InnoDB subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. (CVE-2016-5507)
 - An unspecified flaw exists related to the MyISAM subcomponent. This may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor. (CVE-2016-5616)
 - An unspecified flaw exists related to the Error Handling subcomponent. This may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor. (CVE-2016-5617)
 - An unspecified flaw exists related to the Packaging subcomponent. This may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor. (CVE-2016-5625)
 - An unspecified flaw exists related to the GIS subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. (CVE-2016-5626)
 - An unspecified flaw exists related to the Federated subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. (CVE-2016-5629)
 - An unspecified flaw exists related to the Optimizer subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. (2016-5632)
 - An unspecified flaw exists related to the Types subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. (CVE-2016-8283)
 - An unspecified flaw exists related to the Security: Privileges subcomponent. This may allow an authenticated remote attacker to disclose potentially sensitive information. No further details have been provided by the vendor. (CVE-2016-8286)

ID	Name	Product	Family	Published	Updated	Severity
258104	RHEL 6 / 7：rh-mariadb101-mariadb (RHSA-2016:2928)	Nessus	Red Hat Local Security Checks	8/29/2025	8/29/2025	critical
94440	Slackware 14.1 / 14.2 / 最新版本：mariadb (SSA:2016-305-03)	Nessus	Slackware Local Security Checks	11/1/2016	1/14/2021	high
95633	MariaDB 5.5.0 < 5.5.52 多個弱點	Nessus	Databases	12/8/2016	8/19/2025	high
93379	早於 5.7.15 的 MySQL 5.7.x 版本的多個弱點	Nessus	Databases	9/8/2016	11/14/2019	critical
258104	RHEL 6 / 7：rh-mariadb101-mariadb (RHSA-2016:2928)	Nessus	Red Hat Local Security Checks	8/29/2025	8/29/2025	critical
94196	MySQL 5.5.x < 5.5.53 多個弱點 (2016 年 10 月 CPU)	Nessus	Databases	10/21/2016	6/3/2020	critical
94715	Oracle Linux 7：mariadb (ELSA-2016-2595)	Nessus	Oracle Linux Local Security Checks	11/11/2016	8/29/2025	critical
95847	Scientific Linux 安全性更新：SL7.x x86_64 上的 mariadb	Nessus	Scientific Linux Local Security Checks	12/15/2016	1/14/2021	critical
9610	Oracle MySQL 5.5.x < 5.5.52 Multiple Vulnerabilities	Nessus Network Monitor	Database	9/30/2016	3/6/2019	high
9752	MariaDB Server 10.0.x < 10.0.28 Multiple Vulnerabilities	Nessus Network Monitor	Database	11/4/2016	3/6/2019	high
9614	Oracle MySQL 5.6.x < 5.6.33 Multiple Vulnerabilities	Nessus Network Monitor	Database	9/30/2016	3/6/2019	high
9618	Oracle MySQL 5.7.x < 5.7.15 Multiple Vulnerabilities	Nessus Network Monitor	Database	9/30/2016	3/6/2019	high

Detections

Analytics

Plugins Search

critical

high

high

critical

critical

critical

critical

critical

high

high

high

high