Detections
Analytics
MariaDB Server 10.x < 10.2 Multiple Vulnerabilities
medium Nessus Network Monitor Plugin ID 9754
Synopsis
The remote database server is affected by multiple attack vectors.Description
The version of MariaDB installed on the remote host is 10.x prior to 10.2, and is affected by multiple vulnerabilities :- A flaw exists in the 'create_sort_index()' function in 'sql_select.cc' that is triggered during the handling of crafted 'SELECT' statements. This may allow an authenticated attacker to crash the database.
- A flaw exists in the 'subselect_union_engine::no_rows()' function in 'item_subselect.cc' that is triggered during the handling of crafted 'SELECT' statements. This may allow an authenticated attacker to crash the database.
- A flaw exists in log.cc that is triggered during the handling of specially crafted tabl_map events. This may allow an authenticated attacker to crash the database.
Solution
Upgrade to version 10.x 10.2 or later.See Also
Plugin Details
Severity: Medium
ID: 9754
Family: Database
Published: 11/4/2016
Updated: 3/6/2019
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 6.2
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:mariadb:mariadb
Patch Publication Date: 10/17/2016
Vulnerability Publication Date: 2/3/2016