遠端主機上安裝的 MariaDB 5.5.x 版比 5.5.51 舊。因此受到多個弱點影響：

- 檔案 sql/sys_vars.cc 內的 check_log_path() 函式中存在一個瑕疵，這是因為對於寫入至 my.cnf 組態檔案的能力限制不充分所導致，其允許從非由目前版本使用的路徑位置載入組態檔案。經驗證的遠端攻擊者可惡意利用此問題，透過使用特製的查詢，利用記錄功能來建立新檔案或將自訂內容附加至現有檔案。這允許攻擊者插入使「malloc_lib=」指示詞指向特製 mysql_hookandroot_lib.so 檔案的自訂 .cnf 檔案，進而造成 MySQL 在下次啟動時載入惡意程式庫，來取得 root 權限。(CVE-2016-6662)

- 當在 JOIN 清理期間處理 UNION 查詢時，檔案 sql/sql_union.cc 內的 st_select_lex_unit::cleanup() 函式中存在一個拒絕服務弱點。經驗證的遠端攻擊者可惡意利用此弱點造成資料庫損毀。(VulnDB 143756)

現已提供適用於 Red Hat Enterprise Linux 7 的 mariadb 更新。Red Hat 產品安全性團隊已將此更新評等為具有重要安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。MariaDB 是與 MySQL 二進位相容的多使用者、多執行緒 SQL 資料庫伺服器。下列套件已升級至更新的上游版本： mariadb (5.5.52)。(BZ#1304516、BZ#1377974) 安全性修正：* 據發現，MariaDB 記錄功能會允許寫入至 MariaDB 組態檔案的動作。資料庫管理員使用者或具有 FILE 權限的資料庫使用者可利用此缺陷，在執行資料庫伺服器的系統上以 root 權限執行任意命令。(CVE-2016-6662) * 在 MariaDB 執行 MyISAM 引擎表格修復的方式中，發現爭用情形。對執行 mysqld 的伺服器具有殼層存取權限的資料庫使用者可利用此缺陷，變更 mysql 系統使用者可寫入的任意檔案權限。(CVE-2016-6663) * 此更新可修正 MariaDB 資料庫伺服器中的數個弱點。有關這些缺陷的詳細資訊，請參閱「Oracle 重要修補程式更新公告」頁面的〈參照〉一節內容。(CVE-2016-3492、CVE-2016-5612、CVE-2016-5616、CVE-2016-5624、CVE-2016-5626、CVE-2016-5629、CVE-2016-8283) 其他變更：如需有關此發行版本的詳細變更資訊，請參閱可從〈參照〉一節連結的 Red Hat Enterprise Linux 7.3 版本資訊。

mariadb 的更新现在可用于 Red Hat Enterprise Linux 7。Red Hat 产品安全团队将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。MariaDB 是与 MySQL 兼容的多用户、多线程二进制 SQL 数据库服务器。下列程序包已升级到更新的上游版本：mariadb (5.5.52)。(BZ#1304516, BZ#1377974) 安全修复：* 已发现 MariaDB 登录功能允许写入 MariaDB 配置文件。管理数据库用户，或具有 FILE 权限的数据库用户，可能会利用此缺陷，在运行数据库服务器的系统上利用根权限运行任意命令。(CVE-2016-6662) * 在 MariaDB 执行 MyISAM 引擎表修复的方式中发现争用条件。对运行 mysqld 的服务器具有 shell 访问权的数据库用户，可利用此缺陷更改 mysql 系统用户可写入的任意文件许可。(CVE-2016-6663) * 此更新修复了 MariaDB 数据库服务器中的多个漏洞。有关这些缺陷的信息，请参阅“参考”部分中列出的“Oracle 关键修补程序更新公告”页面。(CVE-2016-3492, CVE-2016-5612, CVE-2016-5616, CVE-2016-5624, CVE-2016-5626, CVE-2016-5629, CVE-2016-8283) 其他更改：如需有关此发行版本的详细变更信息，请参阅可从“参考”部分链接的 Red Hat Enterprise Linux 7.3 版本说明。

远程主机上运行的 MySQL 5.5.x 版本低于 5.5.51。因此，处理某些不明参数时，NAME_CONST() 函数会受到一个拒绝服务漏洞影响。经过认证的远程攻击者可以利用此漏洞造成服务器退出。

请注意，Nessus 没有测试此问题，而仅依赖于应用程序自我报告的版本号。

远程主机上运行的 MySQL 5.6.x 版本低于 5.6.32。因此，它受到多种漏洞的影响：

- 处理某些不明参数时，NAME_CONST() 函数中存在一个拒绝服务漏洞。经过认证的远程攻击者可以利用此漏洞造成服务器退出。(VulnDB 142918)

- 选择已删除表格的全文索引信息方案表时，InnoDB 中存在一个拒绝服务漏洞。经认证的远程攻击者可利用此漏洞造成分段错误。
 (VulnDB 142919)

请注意，Nessus 并未测试这些问题，而是只依赖于应用程序自我报告的版本号。

远程主机上安装的 MariaDB 版本为低于 5.5.51 的 5.5.x。因此，它受到多种漏洞的影响：

- sql/sys_vars.cc 文件的 check_log_path() 函数中存在一个缺陷，这是因为对于写入到 my.cnf 配置文件的功能限制不充分并且允许从目前版本不使用的路径位置加载配置文件所导致。经认证的远程攻击者可利用此问题，通过使用特别构建的查询，利用日志记录功能来创建新文件或将自定义内容附加到现有文件。这允许攻击者通过插入自定义 .cnf 文件来获取根权限，该文件含有指向特别构建的 mysql_hookandroot_lib.so 文件的“malloc_lib=”指令，因此造成 MySQL 在下次启动时加载恶意库。(CVE-2016-6662)

- 当在 JOIN 清理期间处理 UNION 查询时，sql/sql_union.cc 文件的 st_select_lex_unit::cleanup() 函数中存在一个拒绝服务漏洞。经认证的远程攻击者可利用此漏洞致使数据库崩溃。(VulnDB 143756)

According to the versions of the mariadb packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and     earlier, 5.6.29 and earlier, and 5.7.11 and earlier and     MariaDB before 5.5.49, 10.0.x before 10.0.25, and     10.1.x before 10.1.14 allows local users to affect     confidentiality via vectors related to     DML.(CVE-2016-0643)

  - Unspecified vulnerability in Oracle MySQL 5.5.46 and     earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB     before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before     10.1.10 allows remote authenticated users to affect     availability via vectors related to UDF.(CVE-2016-0608)

  - Unspecified vulnerability in Oracle MySQL 5.5.47 and     earlier, 5.6.28 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.48, 10.0.x before 10.0.24, and     10.1.x before 10.1.12 allows local users to affect     availability via vectors related to DDL.(CVE-2016-0644)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.39     and earlier, and 5.6.20 and earlier, allows remote     authenticated users to affect confidentiality,     integrity, and availability via vectors related to     SERVER:DML.(CVE-2014-6507)

  - Unspecified vulnerability in Oracle MySQL 5.5.47 and     earlier, 5.6.28 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.48, 10.0.x before 10.0.24, and     10.1.x before 10.1.12 allows local users to affect     availability via vectors related to DML.(CVE-2016-0646)

  - Unspecified vulnerability in Oracle MySQL 5.5.46 and     earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB     before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before     10.1.10 allows remote authenticated users to affect     availability via unknown vectors related to     InnoDB.(CVE-2016-0600)

  - Unspecified vulnerability in Oracle MySQL 5.5.46 and     earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB     before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before     10.1.10 allows remote authenticated users to affect     availability via unknown vectors related to     Optimizer.(CVE-2016-0597)

  - Buffer overflow in client/mysql.cc in Oracle MySQL and     MariaDB before 5.5.35 allows remote database servers to     cause a denial of service (crash) and possibly execute     arbitrary code via a long server version     string.(CVE-2014-0001)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and     earlier, 5.6.29 and earlier, and 5.7.11 and earlier and     MariaDB before 5.5.49, 10.0.x before 10.0.25, and     10.1.x before 10.1.14 allows local users to affect     availability via vectors related to PS.(CVE-2016-0648)

  - Unspecified vulnerability in Oracle MySQL 5.5.46 and     earlier and 5.6.27 and earlier and MariaDB before     5.5.47, 10.0.x before 10.0.23, and 10.1.x before     10.1.10 allows remote authenticated users to affect     availability via vectors related to DML.(CVE-2016-0596)

  - Unspecified vulnerability in Oracle MySQL 5.5.46 and     earlier and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows remote     authenticated users to affect availability via unknown     vectors related to Optimizer.(CVE-2016-0616)

  - Unspecified vulnerability in Oracle MySQL 5.5.47 and     earlier, 5.6.28 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.48, 10.0.x before 10.0.24, and     10.1.x before 10.1.12 allows local users to affect     availability via vectors related to PS.(CVE-2016-0649)

  - It was found that the MySQL client library permitted     but did not require a client to use SSL/TLS when     establishing a secure connection to a MySQL server     using the ''--ssl'' option. A man-in-the-middle     attacker could use this flaw to strip the SSL/TLS     protection from a connection between a client and a     server.(CVE-2015-3152)

  - Unspecified vulnerability in Oracle MySQL 5.5.50 and     earlier, 5.6.31 and earlier, and 5.7.13 and earlier     allows remote authenticated users to affect     availability via vectors related to DML.(CVE-2016-5612)

  - Unspecified vulnerability in Oracle MySQL 5.5.46 and     earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB     before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before     10.1.10 allows remote authenticated users to affect     integrity via unknown vectors related to     encryption.(CVE-2016-0606)

  - Unspecified vulnerability in Oracle MySQL 5.5.51 and     earlier, 5.6.32 and earlier, and 5.7.14 and earlier     allows remote authenticated users to affect     availability via vectors related to GIS.(CVE-2016-5626)

  - Unspecified vulnerability in Oracle MySQL 5.5.46 and     earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB     before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before     10.1.10 allows remote authenticated users to affect     availability via unknown vectors related to     privileges.(CVE-2016-0609)

  - A flaw was found in the way MySQL client library     (libmysqlclient) handled prepared statements when     server connection was lost. A malicious server or a     man-in-the-middle attacker could possibly use this flaw     to crash an application using     libmysqlclient.(CVE-2017-3302)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and     earlier, 5.6.29 and earlier, and 5.7.11 and earlier and     MariaDB before 5.5.49, 10.0.x before 10.0.25, and     10.1.x before 10.1.14 allows local users to affect     availability via vectors related to FTS.(CVE-2016-0647)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL running on the remote host is 5.5.x prior to 5.5.51. It is, therefore, affected by multiple denial of service vulnerabilities :

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5612)

  - A denial of service vulnerability exists in the     NAME_CONST() function when handling certain unspecified     arguments. An authenticated, remote attacker can exploit     this to cause the server to exit.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for mariadb to 10.0.27 fixes the following issues :

  - release notes :

  - https://kb.askmonty.org/en/mariadb-10027-release-notes

  - https://kb.askmonty.org/en/mariadb-10026-release-notes

  - changelog :

  - https://kb.askmonty.org/en/mariadb-10027-changelog

  - https://kb.askmonty.org/en/mariadb-10026-changelog

  - fixed CVE's 10.0.27: CVE-2016-5612, CVE-2016-5630,     CVE-2016-6662 10.0.26: CVE-2016-5440, CVE-2016-3615,     CVE-2016-3521, CVE-2016-3477

  - fix: [boo#1005561], [boo#1005570], [boo#998309],     [boo#989926], [boo#989922], [boo#989919], [boo#989913]

  - requires devel packages for aio and lzo2

  - remove mariadb-10.0.21-mysql-test_main_bootstrap.patch     that is no longer needed [boo#984858] 

  - append '--ignore-db-dir=lost+found' to the mysqld     options in 'mysql-systemd-helper' script if 'lost+found'     directory is found in $datadir [boo#986251]

  - remove syslog.target from *.service files [boo#983938]

  - add systemd to deps to build on leap and friends 

  - replace '%(_libexecdir)/systemd/system' with %(_unitdir)     macro

  - remove useless mysql@default.service [boo#971456] 

  - make ORDER BY optimization functions take into account     multiple equalities [boo#949520]

  - adjust mysql-test results in order to take account of a     new option (orderby_uses_equalities) added by the     optimizer patch [boo#1003800]

  - replace all occurrences of the string '@sysconfdir@'     with '/etc' in     mysql-community-server-5.1.46-logrotate.patch as it     wasn't expanded properly [boo#990890]

From Red Hat Security Advisory 2016:2595 :

An update for mariadb is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a newer upstream version:
mariadb (5.5.52). (BZ#1304516, BZ#1377974)

Security Fix(es) :

* It was discovered that the MariaDB logging functionality allowed writing to MariaDB configuration files. An administrative database user, or a database user with FILE privileges, could possibly use this flaw to run arbitrary commands with root privileges on the system running the database server. (CVE-2016-6662)

* A race condition was found in the way MariaDB performed MyISAM engine table repair. A database user with shell access to the server running mysqld could use this flaw to change permissions of arbitrary files writable by the mysql system user. (CVE-2016-6663)

* This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
(CVE-2016-3492, CVE-2016-5612, CVE-2016-5616, CVE-2016-5624, CVE-2016-5626, CVE-2016-5629, CVE-2016-8283)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

The following packages have been upgraded to a newer upstream version:
mariadb (5.5.52).

Security Fix(es) :

  - It was discovered that the MariaDB logging functionality     allowed writing to MariaDB configuration files. An     administrative database user, or a database user with     FILE privileges, could possibly use this flaw to run     arbitrary commands with root privileges on the system     running the database server. (CVE-2016-6662)

  - A race condition was found in the way MariaDB performed     MyISAM engine table repair. A database user with shell     access to the server running mysqld could use this flaw     to change permissions of arbitrary files writable by the     mysql system user. (CVE-2016-6663)

(CVE-2016-3492, CVE-2016-5612, CVE-2016-5616, CVE-2016-5624, CVE-2016-5626, CVE-2016-5629, CVE-2016-8283)

Additional Changes :

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mysql: unspecified vulnerability in subcomponent: Server: Option (CPU July 2016) (CVE-2016-3471)

  - mysql: unspecified vulnerability in subcomponent: Server: Parser (CPU July 2016) (CVE-2016-3477)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote     authenticated users to affect availability via vectors related to Server : DDL. (CVE-2015-4815)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of MySQL installed on the remote host is version 5.6.x prior to 5.6.32 and is affected by multiple issues :

 - A flaw exists in the 'NAME_CONST()' function that is triggered during the handling of certain arguments.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in InnoDB that is triggered when selecting full-text index information schema tables for a deleted table.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in a library used by MySQL.  Specifically, the Henry Spencer regex Library (rxspencer) contains an overflow condition that is triggered as certain input is not properly validated.  This may allow a context-dependent attacker to cause a buffer overflow, resulting in an unspecified impact that may include a denial of service in a process linked against the library or potentially allow the execution of arbitrary code.
 - An unspecified flaw exists related to the DML subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. 
 - An unspecified flaw exists related to the InnoDB subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. 
 - An unspecified flaw exists related to the Replication subcomponent. This may allow a local attacker to cause a denial of service. No further details have been provided by the vendor.

The version of MySQL installed on the remote host is version 5.5.x prior to 5.5.51 and is affected by multiple issues :

 - A flaw exists in the 'NAME_CONST()' function that is triggered during the handling of certain arguments.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in a library used by MySQL.  Specifically, the Henry Spencer regex Library (rxspencer) contains an overflow condition that is triggered as certain input is not properly validated.  This may allow a context-dependent attacker to cause a buffer overflow, resulting in an unspecified impact that may include a denial of service in a process linked against the library or potentially allow the execution of arbitrary code.
 - An unspecified flaw exists related to the DML subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.

The version of MySQL installed on the remote host is version 5.7.x prior to 5.7.14 and is affected by multiple issues :

 - A flaw exists in InnoDB that is triggered when selecting full-text index information schema tables for a deleted table.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in InnoDB that is triggered during the handling of 'ALTER TABLE' operations on a table with an indexed virtual column.  This may allow an authenticated attacker to crash the database.
 - A flaw exists in a library used by MySQL.  Specifically, the Henry Spencer regex Library (rxspencer) contains an overflow condition that is triggered as certain input is not properly validated.  This may allow a context-dependent attacker to cause a buffer overflow, resulting in an unspecified impact that may include a denial of service in a process linked against the library or potentially allow the execution of arbitrary code.
 - An unspecified flaw exists related to the DML subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the InnoDB subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Memcached subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Performance Schema subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor. 
 - An unspecified flaw exists related to the RBR subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Security:Audit subcomponent. This may allow an authenticated remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - An unspecified flaw exists related to the Replication subcomponent. This may allow a context-dependent attacker to cause a denial of service. No further details have been provided by the vendor. 

ID	名前	製品	ファミリー	公開日	更新日	深刻度
93611	MariaDB 5.5.x < 5.5.51 多個弱點	Nessus	Databases	2016/9/20	2022/11/18	critical
94558	RHEL 7：mariadb (RHSA-2016:2595)	Nessus	Red Hat Local Security Checks	2016/11/4	2019/10/24	critical
94558	RHEL 7 : mariadb (RHSA-2016:2595)	Nessus	Red Hat Local Security Checks	2016/11/4	2019/10/24	critical
93001	MySQL 5.5.x < 5.5.51 NAME_CONST() 参数 DoS	Nessus	Databases	2016/8/17	2020/6/3	medium
93003	MySQL 5.6.x < 5.6.32 多种漏洞	Nessus	Databases	2016/8/17	2020/6/3	medium
93611	MariaDB 5.5.x < 5.5.51 多种漏洞	Nessus	Databases	2016/9/20	2022/11/18	critical
125007	EulerOS Virtualization 3.0.1.0 : mariadb (EulerOS-SA-2019-1554)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	medium
93000	MySQL 5.5.x < 5.5.51 Multiple DoS	Nessus	Databases	2016/8/17	2019/1/2	medium
94649	openSUSE Security Update : mariadb (openSUSE-2016-1274)	Nessus	SuSE Local Security Checks	2016/11/9	2021/1/19	critical
94715	Oracle Linux 7 : mariadb (ELSA-2016-2595)	Nessus	Oracle Linux Local Security Checks	2016/11/11	2021/1/14	critical
95847	Scientific Linux Security Update : mariadb on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	2016/12/15	2021/1/14	critical
199093	RHEL 6 : mysql55-mysql (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high
9613	Oracle MySQL 5.6.x < 5.6.32 Multiple Vulnerabilities	Nessus Network Monitor	Database	2016/9/30	2019/3/6	high
9609	Oracle MySQL 5.5.x < 5.5.51 Multiple Vulnerabilities	Nessus Network Monitor	Database	2016/9/30	2019/3/6	high
9617	Oracle MySQL 5.7.x < 5.7.14 Multiple Vulnerabilities	Nessus Network Monitor	Database	2016/9/30	2019/3/6	high

検出

プラグインの検索

critical

critical

critical

medium

medium

critical

medium

medium

critical

critical

critical

high

high

high

high