远程主机上运行的 MySQL 版本为低于 5.6.35 的 5.6.x。因此，该服务器受到多个漏洞的影响：

  - Security: Encryption 子组件中存在不明缺陷，允许经身份验证的远程攻击者造成拒绝服务情况。
    (CVE-2016-8318)

  - Replication 子组件中存在一个不明缺陷，允许经认证的远程攻击者造成拒绝服务。
    (CVE-2016-8327)

  - Optimizer 子组件中存在一个不明缺陷，经过身份验证的远程攻击者可利用此漏洞，造成拒绝服务情况。(CVE-2017-3238)

  - DML 子组件中存在不明缺陷，经过身份验证的远程攻击者可利用此缺陷造成拒绝服务情况。(CVE-2017-3244)

  - InnoDB 子组件中存在一个不明缺陷，经过身份验证的远程攻击者可利用此漏洞，造成拒绝服务情况。(CVE-2017-3257)

  - DDL 子组件中存在不明缺陷，经过身份验证的远程攻击者可利用此缺陷造成拒绝服务情况。(CVE-2017-3258)

  - Packaging 子组件中存在一个不明缺陷，本地攻击者可利用此漏洞，影响机密性和可用性。(CVE-2017-3265)

  - DDL 子组件中存在不明缺陷，经过身份验证的远程攻击者可利用此缺陷造成拒绝服务情况。(CVE-2017-3273)

  - Packaging 子组件中存在多个不明缺陷，本地攻击者可利用此漏洞，获取提升的特权。（CVE-2017-3291、CVE-2017-3312）

  - MyISAM 子组件中存在一个不明缺陷，本地攻击者可利用此漏洞，泄露敏感信息。(CVE-2017-3313)

  - Logging 子组件中存在一个不明缺陷，本地攻击者可利用此漏洞，造成拒绝服务情况。(CVE-2017-3317)

  - Error Handling 子组件中存在一个不明缺陷，本地攻击者可利用此漏洞，泄露敏感信息。(CVE-2017-3318)

  - mysqld_safe 组件中存在本地特权提升漏洞，这是以不安全的方式使用“rm”和“chown”命令所致。本地攻击者可利用此问题获得提升的权限。

  - mysqld_safe 组件中存在不明缺陷，允许经身份验证的远程攻击者造成不明影响。

  - 由于处理嵌套表达式时未正确验证用户提供的输入，Optimizer 组件中存在溢出情况。经过认证的远程攻击者可利用此情况造成基于堆栈的缓冲区溢出，从而导致拒绝服务情况。

  - 使用 DATA DIRECTORY 子句处理 CREATE TABLE 查询时，存在不明缺陷。经身份验证的远程攻击者可利用此问题获得提升的权限。

请注意，Nessus 尚未测试这些问题，而是只依靠应用程序自我报告的版本号。

远程主机上运行的 MySQL 版本为低于 5.7.17 的 5.7.x。因此，该服务器受到多个漏洞的影响：

  - Security: Encryption 子组件中存在不明缺陷，允许经身份验证的远程攻击者造成拒绝服务情况。
    (CVE-2016-8318)

  - Replication 子组件中存在一个不明缺陷，允许经认证的远程攻击者造成拒绝服务。
    (CVE-2016-8327)

  - Optimizer 子组件中存在多个不明缺陷，允许经认证的远程攻击者造成拒绝服务情况。
    （CVE-2017-3238、CVE-2017-3251）

  - DML 子组件中存在不明缺陷，经过身份验证的远程攻击者可利用此缺陷造成拒绝服务情况。(CVE-2017-3244)

  - Replication 子组件中存在一个不明缺陷，允许经认证的远程攻击者造成拒绝服务。
    (CVE-2017-3256)

  - InnoDB 子组件中存在一个不明缺陷，经过身份验证的远程攻击者可利用此漏洞，造成拒绝服务情况。(CVE-2017-3257)

  - DDL 子组件中存在不明缺陷，经过身份验证的远程攻击者可利用此缺陷造成拒绝服务情况。(CVE-2017-3258)

  - Packaging 子组件中存在一个不明缺陷，本地攻击者可利用此漏洞，影响机密性和可用性。(CVE-2017-3265)

  - DDL 子组件中存在不明缺陷，经过身份验证的远程攻击者可利用此缺陷造成拒绝服务情况。(CVE-2017-3273)

  - Packaging 子组件中存在多个不明缺陷，本地攻击者可利用此漏洞，获取提升的特权。（CVE-2017-3291、CVE-2017-3312）

  - MyISAM 子组件中存在一个不明缺陷，本地攻击者可利用此漏洞，泄露敏感信息。(CVE-2017-3313)

  - Logging 子组件中存在一个不明缺陷，本地攻击者可利用此漏洞，造成拒绝服务情况。(CVE-2017-3317)

  - Error Handling 子组件中存在一个不明缺陷，本地攻击者可利用此漏洞，泄露敏感信息。(CVE-2017-3318)

  - X Plugin 子组件中存在一个不明缺陷，经过身份验证的远程攻击者可利用此漏洞，泄露敏感信息。(CVE-2017-3319)

  - Security: Encryption 中存在不明缺陷，允许经身份验证的远程攻击者泄露敏感信息。
    (CVE-2017-3320)

  - X Plugin 子组件中存在一个不明缺陷，经过身份验证的远程攻击者可利用此漏洞，造成拒绝服务情况。(CVE-2017-3646)

  - mysqld_safe 组件中存在本地特权提升漏洞，这是以不安全的方式使用“rm”和“chown”命令所致。本地攻击者可利用此问题获得提升的权限。

  - mysqld_safe 组件中存在不明缺陷，允许经身份验证的远程攻击者造成不明影响。

  - 由于处理嵌套表达式时未正确验证用户提供的输入，Optimizer 组件中存在溢出情况。经过认证的远程攻击者可利用此情况造成基于堆栈的缓冲区溢出，从而导致拒绝服务情况。

  - 使用 DATA DIRECTORY 子句处理 CREATE TABLE 查询时，存在不明缺陷。经身份验证的远程攻击者可利用此问题获得提升的权限。

请注意，Nessus 尚未测试这些问题，而是只依靠应用程序自我报告的版本号。

已发现在 MySQL 数据库服务器中存在多个问题。已通过将 MySQL 升级到新的上游版本 5.5.54 来解决这些漏洞，该版本包含更多变更，例如性能改进、缺陷补丁、新功能并可能包含不兼容的变更。请参阅 MySQL 5.5 发行说明和 Oracle 的关键修补程序更新公告，了解更多详情：https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-54.html http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727 .html 对于 Debian 7“Wheezy”，这些问题已在版本 5.5.54-0+deb7u1 中修复。建议您升级 mysql-5.5 程序包。注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动整理和排版。

已发现在 MySQL 数据库服务器中存在多个问题。已通过将 MySQL 升级到新的上游版本 5.5.54 来解决这些漏洞，该版本包含更多变更，例如性能改进、缺陷补丁、新功能并可能包含不兼容的变更。请参阅 MySQL 5.5 发行说明和 Oracle 的关键修补程序更新公告，了解更多详情：- https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5 -54.html - http://www.oracle.com/technetwork/security-advisory/cpuj an2017-2881727.html

下列程序包已升级到更新的上游版本：mariadb (5.5.56)。安全修复：- 已发现 mysql 和 mysqldump 工具未正确处理包含换行符的数据库和表格名称。具有创建数据库或表格权限的数据库用户，当还原使用 mysqldump 工具创建的数据库备份时，会造成 mysql 命令执行任意 shell 或 SQL 命令。(CVE-2016-5483, CVE-2017-3600) - 在 mysqld_safe 脚本处理错误日志文件创建的方式中发现缺陷。Mysql 操作系统用户可利用此缺陷将其权限提升至根权限。(CVE-2016-5617, CVE-2016-6664) - 在 MySQL init 脚本处理数据库数据目录初始化和错误日志文件上之权限设置的方式中发现多个缺陷。Mysql 操作系统用户可利用这些缺陷将其权限提升至根权限。(CVE-2017-3265) - 已发现 mysqld_safe 脚本遵循在 MySQL 配置文件中设置的 ledir 选项值。能够修改其中一个 MySQL 配置文件的用户，可利用此缺陷提升其根权限。(CVE-2017-3291) - 在 mysqld_safe 脚本处理错误日志文件创建的方式中发现多个缺陷。Mysql 操作系统用户可利用这些缺陷将其权限提升至根权限。(CVE-2017-3312) - 当服务器连接丢失时，在 MySQL 客户端库 (libmysqlclient) 处理已准备好的语句的方式中发现缺陷。恶意服务器或中间人攻击者可能会利用此缺陷，造成使用 libmysqlclient 的应用程序发生崩溃。(CVE-2017-3302) (CVE-2017-3238, CVE-2017-3243, CVE-2017-3244, CVE-2017-3258, CVE-2017-3308, CVE-2017-3309, CVE-2017-3313, CVE-2017-3317, CVE-2017-3318, CVE-2017-3453, CVE-2017-3456, CVE-2017-3464)

The version of MariaDB installed on the remote host is 10.0.x prior to 10.0.29, and is affected by multiple vulnerabilities :

 - A flaw exists in the 'check_duplicate_key()' function that is triggered during the handling of error messages.  This may allow an authenticated attacker to crash the database.  Depending on the database's implementation, it varies if this vulnerability requires authenticated access (e.g. daily DBA duties) or may be exploited by a remote attacker (e.g. interfaced via a web application).
 - A flaw exists in the 'JOIN::destroy()' function in 'sql/sql_select.cc' that is triggered during the handling of a specially crafted query.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'date_add_interval()' function in 'sql/sql_time.cc' that is triggered during the handling of INTERVAL arguments.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in 'sql/item_subselect.cc' that is triggered during the handling of queries from the select/unit tree.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'Item::check_well_formed_result()' function in 'sql/item.cc' that is triggered during the handling of row validation.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'lex_one_token()' function in 'sql/sql_lex.cc' that is triggered during the handling of a specially crafted query.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'merge_buffers()' function in 'sql/filesort.cc' that is triggered during the handling of 'sort_union' optimization.  This may allow an authenticated attacker to crash the database. 
 - A flaw exists in the 'Item_cache::safe_charset_converter()' function in 'sql/item.cc' that is triggered during the handling of a specially crafted subselect query item.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in 'scripts/mysqld_safe.sh' related to insecure use of certain shell utilities e.g. chown and rm when handling error log files.  This may allow a local attacker via a symlink attack to gain 'root' privileges.
 - An unspecified flaw exists related to the DDL subcomponent.  This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the DML subcomponent.  This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the InnoDB subcomponent.  This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the 'Server:Optimizer' subcomponent. This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - A flaw exists in 'scripts/mysqld_safe.sh' related to handling of the '--ledir' command line option used to specify the directory where mysqld is stored, as this value may be read from the configuration file.  This may allow a local attacker to gain elevated privileges.
 - A flaw exists in the 'packaging/rpm-oel/mysql.init' initialization script related to insecure use of the chown and chmod utilities.  This may allow a local attacker to potentially gain 'root' privileges.
 - An unspecified flaw exists related to the Logging subcomponent.  This may allow a local attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Error Handling subcomponent.  This may allow a local attacker to gain access to sensitive information.  No further details have been provided by the vendor.
 - A flaw exists in the 'handle_if_exists_options()' function in 'sql/sql_table.cc' that is triggered during the handling of a specially crafted 'ADD FOREIGN KEY' statements.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'handle_if_exists_options()' function in 'sql/sql_table.cc' that is triggered due to missing foreign keys in a second 'ALTER TABLE' statement.  This may allow an authenticated attacker to crash the database.

MariaDB is a community-developed fork of the MySQL relational database.  The version of MariaDB installed on the remote host is 5.5.x earlier than 5.5.54, and is therefore affected by multiple vulnerabilities :

 - A flaw exists in 'scripts/mysqld_safe.sh' that is triggered when handling arguments to 'malloc-lib'.  This may allow a local attacker to potentially gain elevated privileges.
 - A flaw exists in 'sql/item_subselect.cc' that is triggered during the handling of queries from the select/unit tree.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'Item::check_well_formed_result()' function in 'sql/item.cc' that is triggered during the handling of row validation.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'Rpl_filter::parse_filter_rule()' function in 'sql/rpl_filter.cc' that is triggered during the clearing of wildcards.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'lex_one_token()' function in 'sql/sql_lex.cc' that is triggered during the handling of a specially crafted query.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'merge_buffers()' function in 'sql/filesort.cc' that is triggered during the handling of 'sort_union' optimization.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'Item_cache::safe_charset_converter()' function in 'sql/item.cc' that is triggered during the handling of a specially crafted subselect query item.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'st_select_lex::is_merged_child_of()' function in 'sql/sql_lex.cc' that is triggered when handling merged views or derived tables.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in 'sql/item.cc' that is triggered during the handling of a specially crafted subquery.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in 'scripts/mysqld_safe.sh' related to insecure use of certain shell utilities e.g. chown and rm when handling error log files.  This may allow a local attacker via a symlink attack to gain 'root' privileges.
 - An unspecified flaw exists related to the DDL subcomponent.  This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the DML subcomponent.  This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the 'Server:Optimizer' subcomponent. This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - A flaw exists in 'scripts/mysqld_safe.sh' related to handling of the '--ledir' command line option used to specify the directory where mysqld is stored, as this value may be read from the configuration file.  This may allow a local attacker to gain elevated privileges.
 - A flaw exists in the 'packaging/rpm-oel/mysql.init' initialization script related to insecure use of the chown and chmod utilities.  This may allow a local attacker to potentially gain 'root' privileges.
 - An unspecified flaw exists related to the Logging subcomponent.  This may allow a local attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Error Handling subcomponent.  This may allow a local attacker to gain access to sensitive information.  No further details have been provided by the vendor.

MariaDB is a community-developed fork of the MySQL relational database. The version of MariaDB installed on the remote host is 10.1.x earlier than 10.1.21, and is therefore affected by multiple vulnerabilities :

 - A flaw exists in the 'merge_buffers()' function in 'sql/filesort.cc' that is triggered during the handling of 'sort_union' optimization.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'Item_cache::safe_charset_converter()' function in 'sql/item.cc' that is triggered during the handling of a specially crafted subselect query item.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in 'scripts/mysqld_safe.sh' related to insecure use of certain shell utilities e.g. chown and rm when handling error log files.  This may allow a local attacker via a symlink attack to gain 'root' privileges.
 - An unspecified flaw exists related to the DDL subcomponent.  This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the DML subcomponent.  This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the InnoDB subcomponent.  This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the 'Server:Optimizer' subcomponent. This may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - A flaw exists in 'scripts/mysqld_safe.sh' related to handling of the '--ledir' command line option used to specify the directory where mysqld is stored, as this value may be read from the configuration file.  This may allow a local attacker to gain elevated privileges.
 - A flaw exists in the 'packaging/rpm-oel/mysql.init' initialization script related to insecure use of the chown and chmod utilities.  This may allow a local attacker to potentially gain 'root' privileges.
 - An unspecified flaw exists related to the Logging subcomponent.  This may allow a local attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Error Handling subcomponent.  This may allow a local attacker to gain access to sensitive information.  No further details have been provided by the vendor.
 - An out-of-bounds access flaw exists in the 'Item_partition_func_safe_string()' function in 'sql/item.h' that is triggered during the handling of 'information_schema.processlist' tables.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'Table_triggers_list::prepare_record_accessors()' function in 'sql/sql_trigger.cc' that is triggered during the handling of a specially crafted table.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'handle_if_exists_options()' function in 'sql/sql_table.cc' that is triggered during the handling of a specially crafted 'ADD FOREIGN KEY' statements.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'Item::decimal_precision()' function in 'sql/item.cc' that is triggered during the handling of a 'SELECT' statement in a crafted query.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'Field_time::store_TIME_with_warning()' function that is triggered when handling a specially crafted 'INSERT' query. This may allow an authenticated attacker to crash the database.

ID	名稱	產品	系列	已發布	已更新	嚴重性
95879	MySQL 5.6.x < 5.6.35 多个漏洞（2017 年 1 月 CPU）	Nessus	Databases	2016/12/15	2020/6/3	medium
95880	MySQL 5.7.x < 5.7.17 多个漏洞（2017 年 1 月 CPU）（2017 年 7 月 CPU）	Nessus	Databases	2016/12/15	2019/11/13	medium
95881	MySQL 5.7.x < 5.7.17 多个漏洞（2017 年 1 月 CPU）（2017 年 7 月 CPU）	Nessus	Databases	2016/12/15	2020/6/3	medium
96732	Debian DLA-797-1：mysql-5.5 - 安全更新	Nessus	Debian Local Security Checks	2017/1/25	2021/1/11	medium
96638	Debian DSA-3767-1：mysql-5.5 - 安全更新	Nessus	Debian Local Security Checks	2017/1/20	2021/1/11	medium
102648	Scientific Linux 安全更新：SL7.x x86_64 中的 mariadb	Nessus	Scientific Linux Local Security Checks	2017/8/22	2021/1/14	high
9912	MariaDB Server 10.0.x < 10.0.29 Multiple Vulnerabilities	Nessus Network Monitor	Database	2017/1/26	2019/3/6	medium
9911	MariaDB Server 5.5.x < 5.5.54 Multiple Vulnerabilities	Nessus Network Monitor	Database	2017/1/26	2019/3/6	high
9915	MariaDB Server 10.1.x < 10.1.21 Multiple Vulnerabilities	Nessus Network Monitor	Database	2017/1/26	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

high

medium

high

medium