Vulnerabilities > CVE-2016-0668

047910
CVSS 1.7 - LOW
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
MULTIPLE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
high complexity
oracle
mariadb
debian
suse
opensuse
canonical
nessus

Summary

Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier and MariaDB 10.0.x before 10.0.24 and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to InnoDB.

Vulnerable Configurations

Part Description Count
Application
Oracle
44
Application
Mariadb
37
OS
Debian
1
OS
Suse
8
OS
Opensuse
2
OS
Canonical
3

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-1619-1.NASL
    descriptionmariadb was updated to version 10.0.25 to fix 25 security issues. These security issues were fixed : - CVE-2016-0505: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Options (bsc#980904). - CVE-2016-0546: Unspecified vulnerability allowed local users to affect confidentiality, integrity, and availability via unknown vectors related to Client (bsc#980904). - CVE-2016-0596: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0597: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0598: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0600: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to InnoDB (bsc#980904). - CVE-2016-0606: Unspecified vulnerability allowed remote authenticated users to affect integrity via unknown vectors related to encryption (bsc#980904). - CVE-2016-0608: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to UDF (bsc#980904). - CVE-2016-0609: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to privileges (bsc#980904). - CVE-2016-0616: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0640: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to DML (bsc#980904). - CVE-2016-0641: Unspecified vulnerability allowed local users to affect confidentiality and availability via vectors related to MyISAM (bsc#980904). - CVE-2016-0642: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to Federated (bsc#980904). - CVE-2016-0643: Unspecified vulnerability allowed local users to affect confidentiality via vectors related to DML (bsc#980904). - CVE-2016-0644: Unspecified vulnerability allowed local users to affect availability via vectors related to DDL (bsc#980904). - CVE-2016-0646: Unspecified vulnerability allowed local users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0647: Unspecified vulnerability allowed local users to affect availability via vectors related to FTS (bsc#980904). - CVE-2016-0648: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0649: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0650: Unspecified vulnerability allowed local users to affect availability via vectors related to Replication (bsc#980904). - CVE-2016-0651: Unspecified vulnerability allowed local users to affect availability via vectors related to Optimizer (bsc#980904). - CVE-2016-0655: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-0666: Unspecified vulnerability allowed local users to affect availability via vectors related to Security: Privileges (bsc#980904). - CVE-2016-0668: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-2047: The ssl_verify_server_cert function in sql-common/client.c did not properly verify that the server hostname matches a domain name in the subject
    last seen2020-06-01
    modified2020-06-02
    plugin id93158
    published2016-08-29
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93158
    titleSUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:1619-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2016:1619-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(93158);
      script_version("2.8");
      script_cvs_date("Date: 2019/09/11 11:22:13");
    
      script_cve_id("CVE-2016-0505", "CVE-2016-0546", "CVE-2016-0596", "CVE-2016-0597", "CVE-2016-0598", "CVE-2016-0600", "CVE-2016-0606", "CVE-2016-0608", "CVE-2016-0609", "CVE-2016-0616", "CVE-2016-0640", "CVE-2016-0641", "CVE-2016-0642", "CVE-2016-0643", "CVE-2016-0644", "CVE-2016-0646", "CVE-2016-0647", "CVE-2016-0648", "CVE-2016-0649", "CVE-2016-0650", "CVE-2016-0651", "CVE-2016-0655", "CVE-2016-0666", "CVE-2016-0668", "CVE-2016-2047");
    
      script_name(english:"SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:1619-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "mariadb was updated to version 10.0.25 to fix 25 security issues.
    
    These security issues were fixed :
    
      - CVE-2016-0505: Unspecified vulnerability allowed remote
        authenticated users to affect availability via unknown
        vectors related to Options (bsc#980904).
    
      - CVE-2016-0546: Unspecified vulnerability allowed local
        users to affect confidentiality, integrity, and
        availability via unknown vectors related to Client
        (bsc#980904).
    
      - CVE-2016-0596: Unspecified vulnerability allowed remote
        authenticated users to affect availability via vectors
        related to DML (bsc#980904).
    
      - CVE-2016-0597: Unspecified vulnerability allowed remote
        authenticated users to affect availability via unknown
        vectors related to Optimizer (bsc#980904).
    
      - CVE-2016-0598: Unspecified vulnerability allowed remote
        authenticated users to affect availability via vectors
        related to DML (bsc#980904).
    
      - CVE-2016-0600: Unspecified vulnerability allowed remote
        authenticated users to affect availability via unknown
        vectors related to InnoDB (bsc#980904).
    
      - CVE-2016-0606: Unspecified vulnerability allowed remote
        authenticated users to affect integrity via unknown
        vectors related to encryption (bsc#980904).
    
      - CVE-2016-0608: Unspecified vulnerability allowed remote
        authenticated users to affect availability via vectors
        related to UDF (bsc#980904).
    
      - CVE-2016-0609: Unspecified vulnerability allowed remote
        authenticated users to affect availability via unknown
        vectors related to privileges (bsc#980904).
    
      - CVE-2016-0616: Unspecified vulnerability allowed remote
        authenticated users to affect availability via unknown
        vectors related to Optimizer (bsc#980904).
    
      - CVE-2016-0640: Unspecified vulnerability allowed local
        users to affect integrity and availability via vectors
        related to DML (bsc#980904).
    
      - CVE-2016-0641: Unspecified vulnerability allowed local
        users to affect confidentiality and availability via
        vectors related to MyISAM (bsc#980904).
    
      - CVE-2016-0642: Unspecified vulnerability allowed local
        users to affect integrity and availability via vectors
        related to Federated (bsc#980904).
    
      - CVE-2016-0643: Unspecified vulnerability allowed local
        users to affect confidentiality via vectors related to
        DML (bsc#980904).
    
      - CVE-2016-0644: Unspecified vulnerability allowed local
        users to affect availability via vectors related to DDL
        (bsc#980904).
    
      - CVE-2016-0646: Unspecified vulnerability allowed local
        users to affect availability via vectors related to DML
        (bsc#980904).
    
      - CVE-2016-0647: Unspecified vulnerability allowed local
        users to affect availability via vectors related to FTS
        (bsc#980904).
    
      - CVE-2016-0648: Unspecified vulnerability allowed local
        users to affect availability via vectors related to PS
        (bsc#980904).
    
      - CVE-2016-0649: Unspecified vulnerability allowed local
        users to affect availability via vectors related to PS
        (bsc#980904).
    
      - CVE-2016-0650: Unspecified vulnerability allowed local
        users to affect availability via vectors related to
        Replication (bsc#980904).
    
      - CVE-2016-0651: Unspecified vulnerability allowed local
        users to affect availability via vectors related to
        Optimizer (bsc#980904).
    
      - CVE-2016-0655: Unspecified vulnerability allowed local
        users to affect availability via vectors related to
        InnoDB (bsc#980904).
    
      - CVE-2016-0666: Unspecified vulnerability allowed local
        users to affect availability via vectors related to
        Security: Privileges (bsc#980904).
    
      - CVE-2016-0668: Unspecified vulnerability allowed local
        users to affect availability via vectors related to
        InnoDB (bsc#980904).
    
      - CVE-2016-2047: The ssl_verify_server_cert function in
        sql-common/client.c did not properly verify that the
        server hostname matches a domain name in the subject's
        Common Name (CN) or subjectAltName field of the X.509
        certificate, which allowed man-in-the-middle attackers
        to spoof SSL servers via a '/CN=' string in a field in a
        certificate, as demonstrated by
        '/OU=/CN=bar.com/CN=foo.com (bsc#963806).
    
    The update package also includes non-security fixes. See advisory for
    details.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=960961"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=961935"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=963806"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=980904"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0505/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0546/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0596/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0597/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0598/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0600/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0606/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0608/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0609/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0616/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0640/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0641/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0642/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0643/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0644/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0646/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0647/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0648/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0649/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0650/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0651/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0655/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0666/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0668/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-2047/"
      );
      # https://www.suse.com/support/update/announcement/2016/suse-su-20161619-1/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?26886a56"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product :
    
    SUSE Linux Enterprise Workstation Extension 12 :
    
    zypper in -t patch SUSE-SLE-WE-12-2016-964=1
    
    SUSE Linux Enterprise Software Development Kit 12 :
    
    zypper in -t patch SUSE-SLE-SDK-12-2016-964=1
    
    SUSE Linux Enterprise Server 12 :
    
    zypper in -t patch SUSE-SLE-SERVER-12-2016-964=1
    
    SUSE Linux Enterprise Desktop 12 :
    
    zypper in -t patch SUSE-SLE-DESKTOP-12-2016-964=1
    
    To bring your system up-to-date, use 'zypper patch'."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libmysqlclient18");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libmysqlclient18-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libmysqlclient_r18");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mariadb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mariadb-client");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mariadb-client-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mariadb-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mariadb-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mariadb-errormessages");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mariadb-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mariadb-tools-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/20");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/06/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/08/29");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(SLED12|SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12 / SLES12", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES12" && (! preg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP0", os_ver + " SP" + sp);
    if (os_ver == "SLED12" && (! preg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP0", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES12", sp:"0", reference:"libmysqlclient18-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"libmysqlclient18-debuginfo-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"mariadb-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"mariadb-client-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"mariadb-client-debuginfo-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"mariadb-debuginfo-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"mariadb-debugsource-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"mariadb-errormessages-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"mariadb-tools-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"mariadb-tools-debuginfo-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"libmysqlclient18-32bit-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"libmysqlclient18-debuginfo-32bit-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libmysqlclient18-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libmysqlclient18-32bit-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libmysqlclient18-debuginfo-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libmysqlclient18-debuginfo-32bit-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libmysqlclient_r18-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libmysqlclient_r18-32bit-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"mariadb-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"mariadb-client-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"mariadb-client-debuginfo-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"mariadb-debuginfo-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"mariadb-debugsource-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"mariadb-errormessages-10.0.25-20.6.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mariadb");
    }
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2953-1.NASL
    descriptionMultiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 5.5.49 in Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Ubuntu 15.10 has been updated to MySQL 5.6.30. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-48.html http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-49.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-29.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-30.html http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-29857 53.html. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id90678
    published2016-04-22
    reporterUbuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90678
    titleUbuntu 12.04 LTS / 14.04 LTS / 15.10 : mysql-5.5, mysql-5.6 vulnerabilities (USN-2953-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-2953-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(90678);
      script_version("2.10");
      script_cvs_date("Date: 2019/09/18 12:31:45");
    
      script_cve_id("CVE-2016-0639", "CVE-2016-0640", "CVE-2016-0641", "CVE-2016-0642", "CVE-2016-0643", "CVE-2016-0644", "CVE-2016-0646", "CVE-2016-0647", "CVE-2016-0648", "CVE-2016-0649", "CVE-2016-0650", "CVE-2016-0655", "CVE-2016-0661", "CVE-2016-0665", "CVE-2016-0666", "CVE-2016-0668", "CVE-2016-2047");
      script_xref(name:"USN", value:"2953-1");
    
      script_name(english:"Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : mysql-5.5, mysql-5.6 vulnerabilities (USN-2953-1)");
      script_summary(english:"Checks dpkg output for updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Ubuntu host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Multiple security issues were discovered in MySQL and this update
    includes new upstream MySQL versions to fix these issues.
    
    MySQL has been updated to 5.5.49 in Ubuntu 12.04 LTS and Ubuntu 14.04
    LTS. Ubuntu 15.10 has been updated to MySQL 5.6.30.
    
    In addition to security fixes, the updated packages contain bug fixes,
    new features, and possibly incompatible changes.
    
    Please see the following for more information:
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-48.html
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-49.html
    http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-29.html
    http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-30.html
    http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-29857
    53.html.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/2953-1/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Update the affected mysql-server-5.5 and / or mysql-server-5.6
    packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:mysql-server-5.5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:mysql-server-5.6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:15.10");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/27");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/04/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/04/22");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(12\.04|14\.04|15\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 12.04 / 14.04 / 15.10", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"12.04", pkgname:"mysql-server-5.5", pkgver:"5.5.49-0ubuntu0.12.04.1")) flag++;
    if (ubuntu_check(osver:"14.04", pkgname:"mysql-server-5.5", pkgver:"5.5.49-0ubuntu0.14.04.1")) flag++;
    if (ubuntu_check(osver:"15.10", pkgname:"mysql-server-5.6", pkgver:"5.6.30-0ubuntu0.15.10.1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mysql-server-5.5 / mysql-server-5.6");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-780.NASL
    descriptionmariadb was updated to version 10.0.25 to fix 25 security issues. These security issues were fixed : - CVE-2016-0505: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Options (bsc#980904). - CVE-2016-0546: Unspecified vulnerability allowed local users to affect confidentiality, integrity, and availability via unknown vectors related to Client (bsc#980904). - CVE-2016-0596: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0597: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0598: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0600: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to InnoDB (bsc#980904). - CVE-2016-0606: Unspecified vulnerability allowed remote authenticated users to affect integrity via unknown vectors related to encryption (bsc#980904). - CVE-2016-0608: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to UDF (bsc#980904). - CVE-2016-0609: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to privileges (bsc#980904). - CVE-2016-0616: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0640: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to DML (bsc#980904). - CVE-2016-0641: Unspecified vulnerability allowed local users to affect confidentiality and availability via vectors related to MyISAM (bsc#980904). - CVE-2016-0642: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to Federated (bsc#980904). - CVE-2016-0643: Unspecified vulnerability allowed local users to affect confidentiality via vectors related to DML (bsc#980904). - CVE-2016-0644: Unspecified vulnerability allowed local users to affect availability via vectors related to DDL (bsc#980904). - CVE-2016-0646: Unspecified vulnerability allowed local users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0647: Unspecified vulnerability allowed local users to affect availability via vectors related to FTS (bsc#980904). - CVE-2016-0648: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0649: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0650: Unspecified vulnerability allowed local users to affect availability via vectors related to Replication (bsc#980904). - CVE-2016-0651: Unspecified vulnerability allowed local users to affect availability via vectors related to Optimizer (bsc#980904). - CVE-2016-0655: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-0666: Unspecified vulnerability allowed local users to affect availability via vectors related to Security: Privileges (bsc#980904). - CVE-2016-0668: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-2047: The ssl_verify_server_cert function in sql-common/client.c did not properly verify that the server hostname matches a domain name in the subject
    last seen2020-06-05
    modified2016-06-28
    plugin id91871
    published2016-06-28
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/91871
    titleopenSUSE Security Update : mariadb (openSUSE-2016-780)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2016-780.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(91871);
      script_version("2.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2016-0505", "CVE-2016-0546", "CVE-2016-0596", "CVE-2016-0597", "CVE-2016-0598", "CVE-2016-0600", "CVE-2016-0606", "CVE-2016-0608", "CVE-2016-0609", "CVE-2016-0616", "CVE-2016-0640", "CVE-2016-0641", "CVE-2016-0642", "CVE-2016-0643", "CVE-2016-0644", "CVE-2016-0646", "CVE-2016-0647", "CVE-2016-0648", "CVE-2016-0649", "CVE-2016-0650", "CVE-2016-0651", "CVE-2016-0655", "CVE-2016-0666", "CVE-2016-0668", "CVE-2016-2047");
    
      script_name(english:"openSUSE Security Update : mariadb (openSUSE-2016-780)");
      script_summary(english:"Check for the openSUSE-2016-780 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "mariadb was updated to version 10.0.25 to fix 25 security issues.
    
    These security issues were fixed :
    
      - CVE-2016-0505: Unspecified vulnerability allowed remote
        authenticated users to affect availability via unknown
        vectors related to Options (bsc#980904).
    
      - CVE-2016-0546: Unspecified vulnerability allowed local
        users to affect confidentiality, integrity, and
        availability via unknown vectors related to Client
        (bsc#980904).
    
      - CVE-2016-0596: Unspecified vulnerability allowed remote
        authenticated users to affect availability via vectors
        related to DML (bsc#980904).
    
      - CVE-2016-0597: Unspecified vulnerability allowed remote
        authenticated users to affect availability via unknown
        vectors related to Optimizer (bsc#980904).
    
      - CVE-2016-0598: Unspecified vulnerability allowed remote
        authenticated users to affect availability via vectors
        related to DML (bsc#980904).
    
      - CVE-2016-0600: Unspecified vulnerability allowed remote
        authenticated users to affect availability via unknown
        vectors related to InnoDB (bsc#980904).
    
      - CVE-2016-0606: Unspecified vulnerability allowed remote
        authenticated users to affect integrity via unknown
        vectors related to encryption (bsc#980904).
    
      - CVE-2016-0608: Unspecified vulnerability allowed remote
        authenticated users to affect availability via vectors
        related to UDF (bsc#980904).
    
      - CVE-2016-0609: Unspecified vulnerability allowed remote
        authenticated users to affect availability via unknown
        vectors related to privileges (bsc#980904).
    
      - CVE-2016-0616: Unspecified vulnerability allowed remote
        authenticated users to affect availability via unknown
        vectors related to Optimizer (bsc#980904).
    
      - CVE-2016-0640: Unspecified vulnerability allowed local
        users to affect integrity and availability via vectors
        related to DML (bsc#980904).
    
      - CVE-2016-0641: Unspecified vulnerability allowed local
        users to affect confidentiality and availability via
        vectors related to MyISAM (bsc#980904).
    
      - CVE-2016-0642: Unspecified vulnerability allowed local
        users to affect integrity and availability via vectors
        related to Federated (bsc#980904).
    
      - CVE-2016-0643: Unspecified vulnerability allowed local
        users to affect confidentiality via vectors related to
        DML (bsc#980904).
    
      - CVE-2016-0644: Unspecified vulnerability allowed local
        users to affect availability via vectors related to DDL
        (bsc#980904).
    
      - CVE-2016-0646: Unspecified vulnerability allowed local
        users to affect availability via vectors related to DML
        (bsc#980904).
    
      - CVE-2016-0647: Unspecified vulnerability allowed local
        users to affect availability via vectors related to FTS
        (bsc#980904).
    
      - CVE-2016-0648: Unspecified vulnerability allowed local
        users to affect availability via vectors related to PS
        (bsc#980904).
    
      - CVE-2016-0649: Unspecified vulnerability allowed local
        users to affect availability via vectors related to PS
        (bsc#980904).
    
      - CVE-2016-0650: Unspecified vulnerability allowed local
        users to affect availability via vectors related to
        Replication (bsc#980904).
    
      - CVE-2016-0651: Unspecified vulnerability allowed local
        users to affect availability via vectors related to
        Optimizer (bsc#980904).
    
      - CVE-2016-0655: Unspecified vulnerability allowed local
        users to affect availability via vectors related to
        InnoDB (bsc#980904).
    
      - CVE-2016-0666: Unspecified vulnerability allowed local
        users to affect availability via vectors related to
        Security: Privileges (bsc#980904).
    
      - CVE-2016-0668: Unspecified vulnerability allowed local
        users to affect availability via vectors related to
        InnoDB (bsc#980904).
    
      - CVE-2016-2047: The ssl_verify_server_cert function in
        sql-common/client.c did not properly verify that the
        server hostname matches a domain name in the subject's
        Common Name (CN) or subjectAltName field of the X.509
        certificate, which allowed man-in-the-middle attackers
        to spoof SSL servers via a '/CN=' string in a field in a
        certificate, as demonstrated by
        '/OU=/CN=bar.com/CN=foo.com (bsc#963806).
    
    These non-security issues were fixed :
    
      - bsc#961935: Remove the leftovers of 'openSUSE' string in
        the '-DWITH_COMMENT' and 'DCOMPILATION_COMMENT' options
    
      - bsc#970287: remove ha_tokudb.so plugin and
        tokuft_logprint and tokuftdump binaries as TokuDB
        storage engine requires the jemalloc library that isn't
        present in SLE-12-SP1 
    
      - bsc#970295: Fix the leftovers of 'logrotate.d/mysql'
        string in the logrotate error message. Occurrences of
        this string were changed to 'logrotate.d/mariadb' 
    
      - bsc#963810: Add 'log-error' and 'secure-file-priv'
        configuration options
    
      - add '/etc/my.cnf.d/error_log.conf' that specifies
        'log-error = /var/log/mysql/mysqld.log'. If no path is
        set, the error log is written to
        '/var/lib/mysql/$HOSTNAME.err', which is not picked up
        by logrotate.
    
      - add '/etc/my.cnf.d/secure_file_priv.conf' which
        specifies that 'LOAD DATA', 'SELECT ... INTO' and 'LOAD
        FILE()' will only work with files in the directory
        specified by 'secure-file-priv' option
        (='/var/lib/mysql-files')."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=961935"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=963806"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=963810"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=970287"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=970295"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=980904"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected mariadb packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient18");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient18-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient18-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient18-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient_r18");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient_r18-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqld-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqld18");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqld18-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-bench");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-bench-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-client");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-client-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-errormessages");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-test-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-tools-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2016/06/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/06/28");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE42\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE42.1", reference:"libmysqlclient-devel-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"libmysqlclient18-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"libmysqlclient18-debuginfo-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"libmysqlclient_r18-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"libmysqld-devel-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"libmysqld18-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"libmysqld18-debuginfo-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"mariadb-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"mariadb-bench-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"mariadb-bench-debuginfo-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"mariadb-client-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"mariadb-client-debuginfo-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"mariadb-debuginfo-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"mariadb-debugsource-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"mariadb-errormessages-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"mariadb-test-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"mariadb-test-debuginfo-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"mariadb-tools-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"mariadb-tools-debuginfo-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libmysqlclient18-32bit-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libmysqlclient18-debuginfo-32bit-10.0.25-6.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libmysqlclient_r18-32bit-10.0.25-6.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libmysqlclient-devel / libmysqlclient18 / libmysqlclient18-32bit / etc");
    }
    
  • NASL familyDatabases
    NASL idMYSQL_5_6_29.NASL
    descriptionThe version of MySQL running on the remote host is 5.6.x prior to 5.6.29. It is, therefore, affected by multiple vulnerabilities : - A NULL pointer dereference flaw exists in the bundled version of OpenSSL in file rsa_ameth.c due to improper handling of ASN.1 signatures that are missing the PSS parameter. A remote attacker can exploit this to cause the signature verification routine to crash, resulting in a denial of service condition. (CVE-2015-3194) - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to impact integrity and availability. (CVE-2016-0640) - An unspecified flaw exists in the MyISAM subcomponent that allows an authenticated, remote attacker to disclose sensitive information or cause a denial of service condition. (CVE-2016-0641) - An unspecified flaw exists in the DDL subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0644) - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0646) - An unspecified flaw exists in the PS subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0649) - An unspecified flaw exists in the Replication subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0650) - An unspecified flaw exists in the Options subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0661) - An unspecified flaw exists in the Security: Encryption subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0665) - An unspecified flaw exists in the InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0668) - A denial of service vulnerability exists in the bundled OpenSSL library due to improper handling of variables declared as TEXT or BLOB. An authenticated, remote attacker can exploit this to corrupt data or cause a denial of service condition. - A denial of service vulnerability exists that is triggered when handling a
    last seen2020-06-01
    modified2020-06-02
    plugin id89055
    published2016-03-01
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/89055
    titleMySQL 5.6.x < 5.6.29 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(89055);
      script_version("1.13");
      script_cvs_date("Date: 2019/11/20");
    
      script_cve_id(
        "CVE-2015-3194",
        "CVE-2016-0640",
        "CVE-2016-0641",
        "CVE-2016-0644",
        "CVE-2016-0646",
        "CVE-2016-0649",
        "CVE-2016-0650",
        "CVE-2016-0661",
        "CVE-2016-0665",
        "CVE-2016-0668"
      );
    
      script_name(english:"MySQL 5.6.x < 5.6.29 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of MySQL server.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote database server is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of MySQL running on the remote host is 5.6.x prior to
    5.6.29. It is, therefore, affected by multiple vulnerabilities :
    
      - A NULL pointer dereference flaw exists in the bundled
        version of OpenSSL in file rsa_ameth.c due to improper
        handling of ASN.1 signatures that are missing the PSS
        parameter. A remote attacker can exploit this to cause
        the signature verification routine to crash, resulting
        in a denial of service condition. (CVE-2015-3194)
    
      - An unspecified flaw exists in the DML subcomponent that
        allows an authenticated, remote attacker to impact
        integrity and availability. (CVE-2016-0640)
    
      - An unspecified flaw exists in the MyISAM subcomponent
        that allows an authenticated, remote attacker to
        disclose sensitive information or cause a denial of
        service condition. (CVE-2016-0641)
    
      - An unspecified flaw exists in the DDL subcomponent that
        allows an authenticated, remote attacker to cause a
        denial of service condition. (CVE-2016-0644)
    
      - An unspecified flaw exists in the DML subcomponent that
        allows an authenticated, remote attacker to cause a
        denial of service condition. (CVE-2016-0646)
    
      - An unspecified flaw exists in the PS subcomponent that
        allows an authenticated, remote attacker to cause a
        denial of service condition. (CVE-2016-0649)
    
      - An unspecified flaw exists in the Replication
        subcomponent that allows an authenticated, remote
        attacker to cause a denial of service condition.
        (CVE-2016-0650)
    
      - An unspecified flaw exists in the Options subcomponent
        that allows an authenticated, remote attacker to cause a
        denial of service condition. (CVE-2016-0661)
    
      - An unspecified flaw exists in the Security: Encryption
        subcomponent that allows an authenticated, remote
        attacker to cause a denial of service condition.
        (CVE-2016-0665)
    
      - An unspecified flaw exists in the InnoDB subcomponent
        that allows an authenticated, remote attacker to cause a
        denial of service condition. (CVE-2016-0668)
    
      - A denial of service vulnerability exists in the bundled
        OpenSSL library due to improper handling of variables
        declared as TEXT or BLOB. An authenticated, remote
        attacker can exploit this to corrupt data or cause a
        denial of service condition.
    
      - A denial of service vulnerability exists that is
        triggered when handling a 'CREATE TEMPORARY TABLE ..
        SELECT' statement involving BIT columns. An
        authenticated, remote attacker can exploit this to
        create an improper table or cause the server to exit, 
        resulting in a denial of service condition.
    
      - A denial of service vulnerability exists due to an
        unspecified flaw in LOCK TABLES that is triggered when
        opening a temporary MERGE table consisting of a view in
        the list of tables. An authenticated, remote attacker
        can exploit this to cause the server to exit, resulting
        in a denial of service condition.
    
      - A denial of service vulnerability exists due to a flaw
        that is triggered when repeatedly executing 'ALTER TABLE
        v1 CHECK PARTITION' as a prepared statement. An
        authenticated, remote attacker can exploit this to cause
        the server to exit, resulting in a denial of service
        condition.");
      script_set_attribute(attribute:"see_also", value:"https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-29.html");
      # http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a0defed6");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to MySQL version 5.6.29 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-0641");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/12/03");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/02/05");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/01");
    
      script_set_attribute(attribute:"potential_vulnerability", value:"true");
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:mysql");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Databases");
    
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("mysql_version.nasl", "mysql_login.nasl");
      script_require_keys("Settings/ParanoidReport");
      script_require_ports("Services/mysql", 3306);
    
      exit(0);
    }
    
    include("mysql_version.inc");
    
    mysql_check_version(fixed:'5.6.29', min:'5.6', severity:SECURITY_WARNING);
    
  • NASL familyDatabases
    NASL idMYSQL_5_7_11.NASL
    descriptionThe version of MySQL running on the remote host is 5.7.x prior to 5.7.11. It is, therefore, potentially affected by multiple vulnerabilities : - A NULL pointer dereference flaw exists in the bundled version of OpenSSL in file rsa_ameth.c due to improper handling of ASN.1 signatures that are missing the PSS parameter. A remote attacker can exploit this to cause the signature verification routine to crash, resulting in a denial of service condition. (CVE-2015-3194) - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to impact integrity and availability. (CVE-2016-0640) - An unspecified flaw exists in the MyISAM subcomponent that allows an authenticated, remote attacker to disclose sensitive information or cause a denial of service condition. (CVE-2016-0641) - An unspecified flaw exists in the DDL subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0644) - Multiple unspecified flaws exist in the DML subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0646, CVE-2016-0652) - An unspecified flaw exists in the PS subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0649) - An unspecified flaw exists in the Replication subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0650) - An unspecified flaw exists in the FTS subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0653) - Multiple unspecified flaws exist in the InnoDB subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0654, CVE-2016-0656, CVE-2016-0668) - An unspecified flaw exists in the Optimizer subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0658) - An unspecified flaw exists in the Options subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0661) - An unspecified flaw exists in the Performance Schema subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0663) - An unspecified flaw exists in the Security: Encryption subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0665) - A denial of service vulnerability exists in the bundled OpenSSL library due to improper handling of variables declared as TEXT or BLOB. An authenticated, remote attacker can exploit this to corrupt data or cause a denial of service condition. - A denial of service vulnerability exists that is triggered when handling a
    last seen2020-06-01
    modified2020-06-02
    plugin id89056
    published2016-03-01
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/89056
    titleMySQL 5.7.x < 5.7.11 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(89056);
      script_version("1.13");
      script_cvs_date("Date: 2019/11/20");
    
      script_cve_id(
        "CVE-2015-3194",
        "CVE-2016-0640",
        "CVE-2016-0641",
        "CVE-2016-0644",
        "CVE-2016-0646",
        "CVE-2016-0649",
        "CVE-2016-0650",
        "CVE-2016-0652",
        "CVE-2016-0653",
        "CVE-2016-0654",
        "CVE-2016-0656",
        "CVE-2016-0658",
        "CVE-2016-0661",
        "CVE-2016-0663",
        "CVE-2016-0665",
        "CVE-2016-0668"
      );
    
      script_name(english:"MySQL 5.7.x < 5.7.11 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of MySQL server.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote database server is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of MySQL running on the remote host is 5.7.x prior to
    5.7.11. It is, therefore, potentially affected by multiple
    vulnerabilities :
    
      - A NULL pointer dereference flaw exists in the bundled
        version of OpenSSL in file rsa_ameth.c due to improper
        handling of ASN.1 signatures that are missing the PSS
        parameter. A remote attacker can exploit this to cause
        the signature verification routine to crash, resulting
        in a denial of service condition. (CVE-2015-3194)
    
      - An unspecified flaw exists in the DML subcomponent that
        allows an authenticated, remote attacker to impact
        integrity and availability. (CVE-2016-0640)
    
      - An unspecified flaw exists in the MyISAM subcomponent
        that allows an authenticated, remote attacker to
        disclose sensitive information or cause a denial of
        service condition. (CVE-2016-0641)
    
      - An unspecified flaw exists in the DDL subcomponent that
        allows an authenticated, remote attacker to cause a
        denial of service condition. (CVE-2016-0644)
    
      - Multiple unspecified flaws exist in the DML subcomponent
        that allow an authenticated, remote attacker to cause a
        denial of service condition. (CVE-2016-0646,
        CVE-2016-0652)
    
      - An unspecified flaw exists in the PS subcomponent that
        allows an authenticated, remote attacker to cause a
        denial of service condition. (CVE-2016-0649)
    
      - An unspecified flaw exists in the Replication
        subcomponent that allows an authenticated, remote
        attacker to cause a denial of service condition.
        (CVE-2016-0650)
    
      - An unspecified flaw exists in the FTS subcomponent that
        allows an authenticated, remote attacker to cause a
        denial of service condition. (CVE-2016-0653)
    
      - Multiple unspecified flaws exist in the InnoDB
        subcomponent that allow an authenticated, remote
        attacker to cause a denial of service condition.
        (CVE-2016-0654, CVE-2016-0656, CVE-2016-0668)
    
      - An unspecified flaw exists in the Optimizer subcomponent
        that allows an authenticated, remote attacker to cause a
        denial of service condition. (CVE-2016-0658)
    
      - An unspecified flaw exists in the Options subcomponent
        that allows an authenticated, remote attacker to cause a
        denial of service condition. (CVE-2016-0661)
    
      - An unspecified flaw exists in the Performance Schema
        subcomponent that allows an authenticated, remote
        attacker to cause a denial of service condition.
        (CVE-2016-0663)
    
      - An unspecified flaw exists in the Security: Encryption
        subcomponent that allows an authenticated, remote
        attacker to cause a denial of service condition.
        (CVE-2016-0665)
    
      - A denial of service vulnerability exists in the bundled
        OpenSSL library due to improper handling of variables
        declared as TEXT or BLOB. An authenticated, remote
        attacker can exploit this to corrupt data or cause a
        denial of service condition.
    
      - A denial of service vulnerability exists that is
        triggered when handling a 'CREATE TEMPORARY TABLE ..
        SELECT' statement involving BIT columns. An
        authenticated, remote attacker can exploit this to
        create an improper table or cause the server to exit, 
        resulting in a denial of service condition.
    
      - A denial of service vulnerability exists due to improper
        handling of queries that contain 'WHERE 0'. An
        authenticated, remote attacker can exploit this to cause
        an uninitialized read, resulting in a denial of service
        condition.");
      script_set_attribute(attribute:"see_also", value:"https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-11.html");
      # http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a0defed6");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to MySQL version 5.7.11 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-0641");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/12/03");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/02/05");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/01");
    
      script_set_attribute(attribute:"potential_vulnerability", value:"true");
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:mysql");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Databases");
    
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("mysql_version.nasl", "mysql_login.nasl");
      script_require_keys("Settings/ParanoidReport");
      script_require_ports("Services/mysql", 3306);
    
      exit(0);
    }
    
    include("mysql_version.inc");
    
    mysql_check_version(fixed:'5.7.11', min:'5.7', severity:SECURITY_WARNING);
    
  • NASL familyDatabases
    NASL idMYSQL_5_7_11_RPM.NASL
    descriptionThe version of Oracle MySQL installed on the remote host is 5.7.x prior to 5.7.11. It is, therefore, affected by the following vulnerabilities : - A NULL pointer dereference flaw exists in the bundled version of OpenSSL in file rsa_ameth.c due to improper handling of ASN.1 signatures that are missing the PSS parameter. A remote attacker can exploit this to cause the signature verification routine to crash, resulting in a denial of service condition. (CVE-2015-3194) - A flaw exists in the ASN1_TFLG_COMBINE implementation in file tasn_dec.c related to handling malformed X509_ATTRIBUTE structures. A remote attacker can exploit this to cause a memory leak by triggering a decoding failure in a PKCS#7 or CMS application, resulting in a denial of service. (CVE-2015-3195) - An unspecified flaw exists in the DML subcomponent that allows a local attacker to impact integrity and availability. (CVE-2016-0640) - An unspecified flaw exists in the MyISAM subcomponent that allows a local attacker to disclose potentially sensitive information or cause a denial of service condition. (CVE-2016-0641) - An unspecified flaw exists in the DDL subcomponent that allows a local attacker to cause a denial of service condition. (CVE-2016-0644) - Multiple unspecified flaws exist in the DML subcomponent that allow a local attacker to cause a denial of service condition. (CVE-2016-0646, CVE-2016-0652) - An unspecified flaw exists in the PS subcomponent that allows a local attacker to cause a denial of service condition. (CVE-2016-0649) - An unspecified flaw exists in the Replication subcomponent that allows a local attacker to cause a denial of service condition. (CVE-2016-0650) - An unspecified flaw exists in the FTS subcomponent that allows a local attacker to cause a denial of service condition. (CVE-2016-0653) - Multiple unspecified flaws exist in the InnoDB subcomponent that allow a local attacker to cause a denial of service condition. (CVE-2016-0654, CVE-2016-0656, CVE-2016-0668) - An unspecified flaw exists in the Optimizer subcomponent that allows a local attacker to cause a denial of service condition. (CVE-2016-0658) - An unspecified flaw exists in the Options subcomponent that allows a local attacker to cause a denial of service condition. (CVE-2016-0661) - An unspecified flaw exists in the Performance Schema subcomponent that allows a local attacker to cause a denial of service condition. (CVE-2016-0663) - An unspecified flaw exists in the Security: Encryption subcomponent that allows a local attacker to cause a denial of service condition. (CVE-2016-0665) - An unspecified flaw exists in the Security: Encryption subcomponent that allows an unauthenticated, remote attacker to disclose potentially sensitive information. (CVE-2016-3452) - A denial of service vulnerability exists in the bundled OpenSSL library due to improper handling of variables declared as TEXT or BLOB. An authenticated, remote attacker can exploit this to corrupt data or cause a denial of service condition. - A denial of service vulnerability exists that is triggered when handling a
    last seen2020-06-04
    modified2016-05-02
    plugin id90833
    published2016-05-02
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90833
    titleOracle MySQL 5.7.x < 5.7.11 Multiple Vulnerabilities (April 2016 CPU) (July 2016 CPU)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(90833);
      script_version("1.14");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/03");
    
      script_cve_id(
        "CVE-2015-3194",
        "CVE-2015-3195",
        "CVE-2016-0640",
        "CVE-2016-0641",
        "CVE-2016-0644",
        "CVE-2016-0646",
        "CVE-2016-0649",
        "CVE-2016-0650",
        "CVE-2016-0652",
        "CVE-2016-0653",
        "CVE-2016-0654",
        "CVE-2016-0656",
        "CVE-2016-0658",
        "CVE-2016-0661",
        "CVE-2016-0663",
        "CVE-2016-0665",
        "CVE-2016-0668",
        "CVE-2016-3452"
      );
      script_bugtraq_id(
        78623,
        78626,
        86427,
        86431,
        86436,
        86439,
        86442,
        86451,
        86454,
        86463,
        86467,
        86470,
        86496,
        86498,
        86504,
        86511,
        86513,
        91999
      );
    
      script_name(english:"Oracle MySQL 5.7.x < 5.7.11 Multiple Vulnerabilities (April 2016 CPU) (July 2016 CPU)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote host is missing one or more security updates.");
      script_set_attribute(attribute:"description", value:
    "The version of Oracle MySQL installed on the remote host is 5.7.x
    prior to 5.7.11. It is, therefore, affected by the following
    vulnerabilities :
    
      - A NULL pointer dereference flaw exists in the bundled
        version of OpenSSL in file rsa_ameth.c due to improper
        handling of ASN.1 signatures that are missing the PSS
        parameter. A remote attacker can exploit this to cause
        the signature verification routine to crash, resulting
        in a denial of service condition. (CVE-2015-3194)
    
      - A flaw exists in the ASN1_TFLG_COMBINE implementation in
        file tasn_dec.c related to handling malformed
        X509_ATTRIBUTE structures. A remote attacker can exploit
        this to cause a memory leak by triggering a decoding
        failure in a PKCS#7 or CMS application, resulting in a
        denial of service. (CVE-2015-3195)
    
      - An unspecified flaw exists in the DML subcomponent that
        allows a local attacker to impact integrity and
        availability. (CVE-2016-0640)
    
      - An unspecified flaw exists in the MyISAM subcomponent
        that allows a local attacker to disclose potentially
        sensitive information or cause a denial of service
        condition. (CVE-2016-0641)
    
      - An unspecified flaw exists in the DDL subcomponent that
        allows a local attacker to cause a denial of service
        condition. (CVE-2016-0644)
    
      - Multiple unspecified flaws exist in the DML subcomponent
        that allow a local attacker to cause a denial of
        service condition. (CVE-2016-0646, CVE-2016-0652)
    
      - An unspecified flaw exists in the PS subcomponent that
        allows a local attacker to cause a denial of service
        condition. (CVE-2016-0649)
    
      - An unspecified flaw exists in the Replication
        subcomponent that allows a local attacker to cause a
        denial of service condition. (CVE-2016-0650)
    
      - An unspecified flaw exists in the FTS subcomponent that
        allows a local attacker to cause a denial of service
        condition. (CVE-2016-0653)
    
      - Multiple unspecified flaws exist in the InnoDB
        subcomponent that allow a local attacker to cause a
        denial of service condition. (CVE-2016-0654,
        CVE-2016-0656, CVE-2016-0668)
    
      - An unspecified flaw exists in the Optimizer subcomponent
        that allows a local attacker to cause a denial of
        service condition. (CVE-2016-0658)
    
      - An unspecified flaw exists in the Options subcomponent
        that allows a local attacker to cause a denial of
        service condition. (CVE-2016-0661)
    
      - An unspecified flaw exists in the Performance Schema
        subcomponent that allows a local attacker to cause a
        denial of service condition. (CVE-2016-0663)
    
      - An unspecified flaw exists in the Security: Encryption
        subcomponent that allows a local attacker to cause a
        denial of service condition. (CVE-2016-0665)
    
      - An unspecified flaw exists in the Security: Encryption
        subcomponent that allows an unauthenticated, remote
        attacker to disclose potentially sensitive information.
        (CVE-2016-3452)
    
      - A denial of service vulnerability exists in the bundled
        OpenSSL library due to improper handling of variables
        declared as TEXT or BLOB. An authenticated, remote
        attacker can exploit this to corrupt data or cause a
        denial of service condition.
    
      - A denial of service vulnerability exists that is
        triggered when handling a 'CREATE TEMPORARY TABLE ..
        SELECT' statement involving BIT columns. An
        authenticated, remote attacker can exploit this to
        create an improper table or cause the server to exit, 
        resulting in a denial of service condition.
    
      - A denial of service vulnerability exists due to improper
        handling of queries that contain 'WHERE 0'. An
        authenticated, remote attacker can exploit this to cause
        an uninitialized read, resulting in a denial of service
        condition.");
      # https://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/2948264.xml
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ae0f7f52");
      # http://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/3089849.xml
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?42cde00c");
      script_set_attribute(attribute:"see_also", value:"https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-11.html");
      script_set_attribute(attribute:"see_also", value:"https://support.oracle.com/rs?type=doc&id=2120034.1");
      script_set_attribute(attribute:"see_also", value:"https://support.oracle.com/rs?type=doc&id=2157431.1");
      # https://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ffb7b96f");
      # http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?453b5f8c");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to MySQL version 5.7.11 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-0641");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/12/03");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/04/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/05/02");
    
      script_set_attribute(attribute:"agent", value:"unix");
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mysql");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Databases");
    
      script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled");
      script_require_ports("Host/RedHat/release", "Host/AmazonLinux/release", "Host/SuSE/release", "Host/CentOS/release");
    
      exit(0);
    }
    
    include("mysql_version.inc");
    
    fix_version = "5.7.11";
    exists_version = "5.7";
    
    mysql_check_rpms(mysql_packages:default_mysql_rpm_list_server_only, fix_ver:fix_version, exists_ver:exists_version, rhel_os_list:default_mysql_rhel_os_list, centos_os_list:default_mysql_centos_os_list, suse_os_list:default_mysql_suse_os_list, ala_os_list:default_mysql_ala_os_list, severity:SECURITY_WARNING);
    
  • NASL familyDatabases
    NASL idMARIADB_10_1_12.NASL
    descriptionThe version of MariaDB running on the remote host is 10.1.x prior to 10.1.12. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to impact integrity and availability. (CVE-2016-0640) - An unspecified flaw exists in the MyISAM subcomponent that allows an authenticated, remote attacker to disclose sensitive information or cause a denial of service condition. (CVE-2016-0641) - An unspecified flaw exists in the DDL subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0644) - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0646) - An unspecified flaw exists in the PS subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0649) - An unspecified flaw exists in the Replication subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0650) - An unspecified flaw exists in the InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0668) - A denial of service vulnerability exists in the SELECT_LEX::update_used_tables() function in sql_lex.cc due to improper handling of semi-join conditions on used table updates. An authenticated, remote attacker can exploit this to crash the database. - A denial of service vulnerability exists in the JOIN::choose_subquery_plan() function in opt_subselect.cc due to improper handling of nested IN clauses that contain SQ. An authenticated, remote attacker can exploit this to crash the database. - A denial of service vulnerability exists in the select_create::prepare() function in sql_insert.cc due to improper handling of stored procedures in new tables. An authenticated, remote attacker can exploit this to crash the database. - A denial of service vulnerability exists in item_cmpfunc.cc due to improper handling of EXECUTE statements. An authenticated, remote attacker can exploit this to crash the database. - A denial of service vulnerability exists in the subselect_hash_sj_engine::exec() function in item_subselect.cc due to improper handling of UNION ALL statements. An authenticated, remote attacker can exploit this to crash the database. - A denial of service vulnerability exists in the Rows_log_event::process_triggers() function in log_event.cc due to improper handling of the update statement for minimal row image sets. An authenticated, remote attacker can exploit this to crash the database. - A denial of service vulnerability exists in sql_select.cc due to improper creation of keys in temporary tables. An authenticated, remote attacker can exploit this to crash the database. Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id93829
    published2016-10-03
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93829
    titleMariaDB 10.1.x < 10.1.12 Multiple Vulnerabilities
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3595.NASL
    descriptionSeveral issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.25. Please see the MariaDB 10.0 Release Notes for further details : - https://mariadb.com/kb/en/mariadb/mariadb-10024-release- notes/ - https://mariadb.com/kb/en/mariadb/mariadb-10025-release- notes/
    last seen2020-06-01
    modified2020-06-02
    plugin id91474
    published2016-06-06
    reporterThis script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91474
    titleDebian DSA-3595-1 : mariadb-10.0 - security update
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-607.NASL
    descriptionThis mysql-community-server version update to 5.6.30 fixes the following issues : Security issues fixed : - fixed CVEs (boo#962779, boo#959724): CVE-2016-0705, CVE-2016-0639, CVE-2015-3194, CVE-2016-0640, CVE-2016-2047, CVE-2016-0644, CVE-2016-0646, CVE-2016-0647, CVE-2016-0648, CVE-2016-0649, CVE-2016-0650, CVE-2016-0665, CVE-2016-0666, CVE-2016-0641, CVE-2016-0642, CVE-2016-0655, CVE-2016-0661, CVE-2016-0668, CVE-2016-0643 - changes http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 30.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 29.html Bugs fixed : - don
    last seen2020-06-05
    modified2016-05-20
    plugin id91277
    published2016-05-20
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91277
    titleopenSUSE Security Update : mysql-community-server (openSUSE-2016-607)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-761.NASL
    descriptionmariadb was updated to version 10.0.25 to fix 25 security issues. These security issues were fixed : - CVE-2016-0505: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Options (bsc#980904). - CVE-2016-0546: Unspecified vulnerability allowed local users to affect confidentiality, integrity, and availability via unknown vectors related to Client (bsc#980904). - CVE-2016-0596: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0597: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0598: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0600: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to InnoDB (bsc#980904). - CVE-2016-0606: Unspecified vulnerability allowed remote authenticated users to affect integrity via unknown vectors related to encryption (bsc#980904). - CVE-2016-0608: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to UDF (bsc#980904). - CVE-2016-0609: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to privileges (bsc#980904). - CVE-2016-0616: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0640: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to DML (bsc#980904). - CVE-2016-0641: Unspecified vulnerability allowed local users to affect confidentiality and availability via vectors related to MyISAM (bsc#980904). - CVE-2016-0642: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to Federated (bsc#980904). - CVE-2016-0643: Unspecified vulnerability allowed local users to affect confidentiality via vectors related to DML (bsc#980904). - CVE-2016-0644: Unspecified vulnerability allowed local users to affect availability via vectors related to DDL (bsc#980904). - CVE-2016-0646: Unspecified vulnerability allowed local users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0647: Unspecified vulnerability allowed local users to affect availability via vectors related to FTS (bsc#980904). - CVE-2016-0648: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0649: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0650: Unspecified vulnerability allowed local users to affect availability via vectors related to Replication (bsc#980904). - CVE-2016-0651: Unspecified vulnerability allowed local users to affect availability via vectors related to Optimizer (bsc#980904). - CVE-2016-0655: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-0666: Unspecified vulnerability allowed local users to affect availability via vectors related to Security: Privileges (bsc#980904). - CVE-2016-0668: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-2047: The ssl_verify_server_cert function in sql-common/client.c did not properly verify that the server hostname matches a domain name in the subject
    last seen2020-06-05
    modified2016-06-24
    plugin id91794
    published2016-06-24
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/91794
    titleopenSUSE Security Update : mariadb (openSUSE-2016-761)
  • NASL familyDatabases
    NASL idMYSQL_5_6_29_RPM.NASL
    descriptionThe version of Oracle MySQL installed on the remote host is 5.6.x prior to 5.6.29. It is, therefore, affected by the following vulnerabilities : - A NULL pointer dereference flaw exists in the bundled version of OpenSSL in file rsa_ameth.c due to improper handling of ASN.1 signatures that are missing the PSS parameter. A remote attacker can exploit this to cause the signature verification routine to crash, resulting in a denial of service condition. (CVE-2015-3194) - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to impact integrity and availability. (CVE-2016-0640) - An unspecified flaw exists in the MyISAM subcomponent that allows an authenticated, remote attacker to disclose sensitive information or cause a denial of service condition. (CVE-2016-0641) - An unspecified flaw exists in the DDL subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0644) - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0646) - An unspecified flaw exists in the PS subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0649) - An unspecified flaw exists in the Replication subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0650) - An unspecified flaw exists in the Options subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0661) - An unspecified flaw exists in the Security: Encryption subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0665) - An unspecified flaw exists in the InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0668) - A denial of service vulnerability exists in the bundled OpenSSL library due to improper handling of variables declared as TEXT or BLOB. An authenticated, remote attacker can exploit this to corrupt data or cause a denial of service condition. - A denial of service vulnerability exists that is triggered when handling a
    last seen2020-06-04
    modified2016-05-02
    plugin id90831
    published2016-05-02
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90831
    titleOracle MySQL 5.6.x < 5.6.29 Multiple Vulnerabilities (April 2016 CPU)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_8C2B2F110EBE11E6B55EB499BAEBFEAF.NASL
    descriptionOracle reports reports : Critical Patch Update contains 31 new security fixes for Oracle MySQL 5.5.48, 5.6.29, 5.7.11 and earlier
    last seen2020-06-01
    modified2020-06-02
    plugin id90847
    published2016-05-03
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90847
    titleFreeBSD : MySQL -- multiple vulnerabilities (8c2b2f11-0ebe-11e6-b55e-b499baebfeaf)
  • NASL familyDatabases
    NASL idMARIADB_10_0_24.NASL
    descriptionThe version of MariaDB running on the remote host is 10.0.x prior to 10.0.24. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to impact integrity and availability. (CVE-2016-0640) - An unspecified flaw exists in the MyISAM subcomponent that allows an authenticated, remote attacker to disclose sensitive information or cause a denial of service condition. (CVE-2016-0641) - An unspecified flaw exists in the DDL subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0644) - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0646) - An unspecified flaw exists in the PS subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0649) - An unspecified flaw exists in the Replication subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0650) - An unspecified flaw exists in the InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0668) - A denial of service vulnerability exists in the SELECT_LEX::update_used_tables() function in sql_lex.cc due to improper handling of semi-join conditions on used table updates. An authenticated, remote attacker can exploit this to crash the database. - A denial of service vulnerability exists in the JOIN::choose_subquery_plan() function in opt_subselect.cc due to improper handling of nested IN clauses that contain SQ. An authenticated, remote attacker can exploit this to crash the database. - A denial of service vulnerability exists in the select_create::prepare() function in sql_insert.cc due to improper handling of stored procedures in new tables. An authenticated, remote attacker can exploit this to crash the database. - A denial of service vulnerability exists in sql_select.cc due to improper creation of keys in temporary tables. An authenticated, remote attacker can exploit this to crash the database. Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id93828
    published2016-10-03
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93828
    titleMariaDB 10.0.x < 10.0.24 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-1620-1.NASL
    descriptionmariadb was updated to version 10.0.25 to fix 25 security issues. These security issues were fixed : - CVE-2016-0505: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Options (bsc#980904). - CVE-2016-0546: Unspecified vulnerability allowed local users to affect confidentiality, integrity, and availability via unknown vectors related to Client (bsc#980904). - CVE-2016-0596: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0597: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0598: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0600: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to InnoDB (bsc#980904). - CVE-2016-0606: Unspecified vulnerability allowed remote authenticated users to affect integrity via unknown vectors related to encryption (bsc#980904). - CVE-2016-0608: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to UDF (bsc#980904). - CVE-2016-0609: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to privileges (bsc#980904). - CVE-2016-0616: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0640: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to DML (bsc#980904). - CVE-2016-0641: Unspecified vulnerability allowed local users to affect confidentiality and availability via vectors related to MyISAM (bsc#980904). - CVE-2016-0642: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to Federated (bsc#980904). - CVE-2016-0643: Unspecified vulnerability allowed local users to affect confidentiality via vectors related to DML (bsc#980904). - CVE-2016-0644: Unspecified vulnerability allowed local users to affect availability via vectors related to DDL (bsc#980904). - CVE-2016-0646: Unspecified vulnerability allowed local users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0647: Unspecified vulnerability allowed local users to affect availability via vectors related to FTS (bsc#980904). - CVE-2016-0648: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0649: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0650: Unspecified vulnerability allowed local users to affect availability via vectors related to Replication (bsc#980904). - CVE-2016-0651: Unspecified vulnerability allowed local users to affect availability via vectors related to Optimizer (bsc#980904). - CVE-2016-0655: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-0666: Unspecified vulnerability allowed local users to affect availability via vectors related to Security: Privileges (bsc#980904). - CVE-2016-0668: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-2047: The ssl_verify_server_cert function in sql-common/client.c did not properly verify that the server hostname matches a domain name in the subject
    last seen2020-06-01
    modified2020-06-02
    plugin id93159
    published2016-08-29
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93159
    titleSUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:1620-1)

Redhat

advisories
  • rhsa
    idRHSA-2016:0705
  • rhsa
    idRHSA-2016:1132
rpms
  • rh-mysql56-mysql-0:5.6.30-1.el6
  • rh-mysql56-mysql-0:5.6.30-1.el7
  • rh-mysql56-mysql-bench-0:5.6.30-1.el6
  • rh-mysql56-mysql-bench-0:5.6.30-1.el7
  • rh-mysql56-mysql-common-0:5.6.30-1.el6
  • rh-mysql56-mysql-common-0:5.6.30-1.el7
  • rh-mysql56-mysql-config-0:5.6.30-1.el6
  • rh-mysql56-mysql-config-0:5.6.30-1.el7
  • rh-mysql56-mysql-debuginfo-0:5.6.30-1.el6
  • rh-mysql56-mysql-debuginfo-0:5.6.30-1.el7
  • rh-mysql56-mysql-devel-0:5.6.30-1.el6
  • rh-mysql56-mysql-devel-0:5.6.30-1.el7
  • rh-mysql56-mysql-errmsg-0:5.6.30-1.el6
  • rh-mysql56-mysql-errmsg-0:5.6.30-1.el7
  • rh-mysql56-mysql-server-0:5.6.30-1.el6
  • rh-mysql56-mysql-server-0:5.6.30-1.el7
  • rh-mysql56-mysql-test-0:5.6.30-1.el6
  • rh-mysql56-mysql-test-0:5.6.30-1.el7
  • rh-mariadb100-mariadb-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-bench-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-bench-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-common-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-common-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-config-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-config-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-debuginfo-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-debuginfo-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-devel-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-devel-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-errmsg-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-errmsg-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-oqgraph-engine-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-oqgraph-engine-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-server-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-server-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-test-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-test-1:10.0.25-4.el7