openSUSE 安全性更新:mysql-community-server (openSUSE-2016-607)

critical Nessus Plugin ID 91277

概要

遠端 openSUSE 主機缺少安全性更新。

說明

此 5.6.30 的 mysql-community-server 版本更新可修正下列問題:

修正的安全性問題:

- 修正 CVE (boo#962779、boo#959724): CVE-2016-0705、CVE-2016-0639、CVE-2015-3194、CVE-2016-0640、CVE-2016-2047、CVE-2016-0644、CVE-2016-0646、CVE-2016-0647、CVE-2016-0648、CVE-2016-0649、CVE-2016-0650、CVE-2016-0665、CVE-2016-0666、CVE-2016-0641、CVE-2016-0642、CVE-2016-0655、CVE-2016-0661、CVE-2016-0668、CVE-2016-0643

- 變更 http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-30.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-29.html

修正的錯誤:

- 移轉失敗時不刪除記錄資料

- 新增「log-error」和「secure-file-priv」組態選項 (已透過 configuration-tweaks.tar.bz2 新增) [boo#963810]

- 新增「/etc/my.cnf.d/error_log.conf」,其指定「log-error = /var/log/mysql/mysqld.log」。若未設定路徑,會將錯誤記錄寫入並非由 logrotate 擷取的「/var/lib/mysql/$HOSTNAME.err」。

- 新增「/etc/my.cnf.d/secure_file_priv.conf」,其指定「LOAD DATA」、「SELECT ...INTO」和「LOAD FILE()」僅處理「secure-file-priv」選項指定之目錄中的檔案 (=「/var/lib/mysql-files」)。

解決方案

更新受影響的 mysql-community-server 套件。

另請參閱

https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-29.html

https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-30.html

https://bugzilla.opensuse.org/show_bug.cgi?id=959724

https://bugzilla.opensuse.org/show_bug.cgi?id=962779

https://bugzilla.opensuse.org/show_bug.cgi?id=963810

Plugin 詳細資訊

嚴重性: Critical

ID: 91277

檔案名稱: openSUSE-2016-607.nasl

版本: 2.5

類型: local

代理程式: unix

已發布: 2016/5/20

已更新: 2021/1/19

支援的感應器: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus

風險資訊

VPR

風險因素: Medium

分數: 6.7

CVSS v2

風險因素: Critical

基本分數: 10

媒介: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

風險因素: Critical

基本分數: 9.8

媒介: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

弱點資訊

CPE: p-cpe:/a:novell:opensuse:libmysql56client18, p-cpe:/a:novell:opensuse:libmysql56client18-32bit, p-cpe:/a:novell:opensuse:libmysql56client18-debuginfo, p-cpe:/a:novell:opensuse:libmysql56client18-debuginfo-32bit, p-cpe:/a:novell:opensuse:libmysql56client_r18, p-cpe:/a:novell:opensuse:libmysql56client_r18-32bit, p-cpe:/a:novell:opensuse:mysql-community-server, p-cpe:/a:novell:opensuse:mysql-community-server-bench, p-cpe:/a:novell:opensuse:mysql-community-server-bench-debuginfo, p-cpe:/a:novell:opensuse:mysql-community-server-client, p-cpe:/a:novell:opensuse:mysql-community-server-client-debuginfo, p-cpe:/a:novell:opensuse:mysql-community-server-debuginfo, p-cpe:/a:novell:opensuse:mysql-community-server-debugsource, p-cpe:/a:novell:opensuse:mysql-community-server-errormessages, p-cpe:/a:novell:opensuse:mysql-community-server-test, p-cpe:/a:novell:opensuse:mysql-community-server-test-debuginfo, p-cpe:/a:novell:opensuse:mysql-community-server-tools, p-cpe:/a:novell:opensuse:mysql-community-server-tools-debuginfo, cpe:/o:novell:opensuse:13.2, cpe:/o:novell:opensuse:42.1

必要的 KB 項目: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

修補程式發佈日期: 2016/5/18

參考資訊

CVE: CVE-2015-3194, CVE-2016-0639, CVE-2016-0640, CVE-2016-0641, CVE-2016-0642, CVE-2016-0643, CVE-2016-0644, CVE-2016-0646, CVE-2016-0647, CVE-2016-0648, CVE-2016-0649, CVE-2016-0650, CVE-2016-0655, CVE-2016-0661, CVE-2016-0665, CVE-2016-0666, CVE-2016-0668, CVE-2016-0705, CVE-2016-2047