The version of MariaDB installed on the remote host is prior to 10.0.20. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.0.20 advisory.

  - Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before     5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to     spoof servers via a cleartext-downgrade attack, aka a BACKRONYM attack. (CVE-2015-3152)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote     authenticated users to affect availability via vectors related to GIS. (CVE-2015-2582)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote     authenticated users to affect confidentiality via unknown vectors related to Server : Security :
    Privileges. (CVE-2015-2620)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote     authenticated users to affect availability via unknown vectors related to Server : Optimizer.
    (CVE-2015-2643)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote     authenticated users to affect availability via vectors related to DML. (CVE-2015-2648)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated mysql55-mysql packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory pages, listed in the References section. (CVE-2014-6568, CVE-2015-0374, CVE-2015-0381, CVE-2015-0382, CVE-2015-0391, CVE-2015-0411, CVE-2015-0432, CVE-2015-0433, CVE-2015-0441, CVE-2015-0499, CVE-2015-0501, CVE-2015-0505, CVE-2015-2568, CVE-2015-2571, CVE-2015-2573, CVE-2015-2582, CVE-2015-2620, CVE-2015-2643, CVE-2015-2648, CVE-2015-4737, CVE-2015-4752, CVE-2015-4757)

These updated packages upgrade MySQL to version 5.5.45. Refer to the MySQL Release Notes listed in the References section for a complete list of changes.

All MySQL users should upgrade to these updated packages, which correct these issues. After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2674-1 advisory.

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to     fix these issues.

    MySQL has been updated to 5.5.44 in Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 14.10. Ubuntu 15.04 has     been updated to MySQL 5.6.25.

    In addition to security fixes, the updated packages contain bug fixes, new features, and possibly     incompatible changes.

    Please see the following for more information:
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-44.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-25.html     http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

MySQL was updated to version 5.5.45, fixing bugs and security issues.

A list of all changes can be found on :

- http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-45.html

- http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-44.html

To fix the 'BACKRONYM' security issue (CVE-2015-3152) the behaviour of the SSL options was changed slightly to meet expectations: Now using '--ssl-verify-server-cert' and '--ssl[-*]' implies that the ssl connection is required. The mysql client will now print an error if ssl is required, but the server can not handle a ssl connection [bnc#924663], [bnc#928962], [CVE-2015-3152]

Additional bugs fixed :

  - fix rc.mysql-multi script to start instances after     restart properly [bnc#934401].

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several issues have been discovered in the MariaDB database server.
The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.20. Please see the MariaDB 10.0 Release Notes for further details :

  -     https://mariadb.com/kb/en/mariadb/mariadb-10017-release-     notes/
  -     https://mariadb.com/kb/en/mariadb/mariadb-10018-release-     notes/

  -     https://mariadb.com/kb/en/mariadb/mariadb-10019-release-     notes/

  -     https://mariadb.com/kb/en/mariadb/mariadb-10020-release-     notes/

ID	名稱	產品	系列	已發布	已更新	嚴重性
84796	MariaDB 10.0.0 < 10.0.20 Multiple Vulnerabilities	Nessus	Databases	2015/7/16	2026/1/29	medium
85460	CentOS 5 : mysql55-mysql (CESA-2015:1628)	Nessus	CentOS Local Security Checks	2015/8/18	2021/1/4	high
84915	Ubuntu 14.04 LTS : MySQL vulnerabilities (USN-2674-1)	Nessus	Ubuntu Local Security Checks	2015/7/22	2024/8/27	medium
86537	SUSE SLED11 / SLES11 Security Update : mysql (SUSE-SU-2015:1788-1) (BACKRONYM)	Nessus	SuSE Local Security Checks	2015/10/22	2021/1/6	medium
84839	Debian DSA-3311-1 : mariadb-10.0 - security update (BACKRONYM)	Nessus	Debian Local Security Checks	2015/7/20	2021/1/11	medium

偵測

搜尋 Plugin

medium

high

medium

medium

medium