This MySQL version update to 5.0.94 update fixes the following security issues :

  - CVE-2010-3833: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3834: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Insufficient Information     (CWE-noinfo)

  - CVE-2010-3835: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Numeric Errors (CWE-189)

  - CVE-2010-3836: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3837: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3838: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Other (CWE-Other)

  - CVE-2010-3839: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Design Error     (CWE-DesignError)

  - CVE-2010-3840: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Other (CWE-Other)

This update fixes the following security issue :

  - 676974: mysql-cluster: security issues fixed in MySQL     5.1.51

This update also fixes the following non-security issue :

  - 635645: mysql init script fails to start when SELinux is     enabled

Multiple vulnerabilities were discovered and corrected in mysql :

  - During evaluation of arguments to extreme-value     functions (such as LEAST() and GREATEST()), type errors     did not propagate properly, causing the server to crash     (CVE-2010-3833).

  - The server could crash after materializing a derived     table that required a temporary table for grouping     (CVE-2010-3834).

  - A user-variable assignment expression that is evaluated     in a logical expression context can be precalculated in     a temporary table for GROUP BY. However, when the     expression value is used after creation of the temporary     table, it was re-evaluated, not read from the table and     a server crash resulted (CVE-2010-3835).

  - Pre-evaluation of LIKE predicates during view     preparation could cause a server crash (CVE-2010-3836).

  - GROUP_CONCAT() and WITH ROLLUP together could cause a     server crash (CVE-2010-3837).

  - Queries could cause a server crash if the GREATEST() or     LEAST() function had a mixed list of numeric and     LONGBLOB arguments, and the result of such a function     was processed using an intermediate temporary table     (CVE-2010-3838).

  - Queries with nested joins could cause an infinite loop     in the server when used from stored procedures and     prepared statements (CVE-2010-3839).

  - The PolyFromWKB() function could crash the server when     improper WKB data was passed to the function     (CVE-2010-3840).

The updated packages have been patched to correct these issues.

It was found that the MySQL PolyFromWKB() function did not sanity check Well-Known Binary (WKB) data. A remote, authenticated attacker could use specially crafted WKB data to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3840)

A flaw was found in the way MySQL processed certain JOIN queries. If a stored procedure contained JOIN queries, and that procedure was executed twice in sequence, it could cause an infinite loop, leading to excessive CPU use (up to 100%). A remote, authenticated attacker could use this flaw to cause a denial of service. (CVE-2010-3839)

A flaw was found in the way MySQL processed queries that provide a mixture of numeric and longblob data types to the LEAST or GREATEST function. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3838)

A flaw was found in the way MySQL processed PREPARE statements containing both GROUP_CONCAT and the WITH ROLLUP modifier. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3837)

It was found that MySQL did not properly pre-evaluate LIKE arguments in view prepare mode. A remote, authenticated attacker could possibly use this flaw to crash mysqld. (CVE-2010-3836)

A flaw was found in the way MySQL processed statements that assign a value to a user-defined variable and that also contain a logical value evaluation. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3835)

A flaw was found in the way MySQL evaluated the arguments of extreme-value functions, such as LEAST and GREATEST. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3833)

A flaw was found in the way MySQL processed EXPLAIN statements for some complex SELECT queries. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3682)

A flaw was found in the way MySQL processed certain alternating READ requests provided by HANDLER statements. A remote, authenticated attacker could use this flaw to provide such requests, causing mysqld to crash. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3681)

A flaw was found in the way MySQL processed CREATE TEMPORARY TABLE statements that define NULL columns when using the InnoDB storage engine. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3680)

A flaw was found in the way MySQL processed JOIN queries that attempt to retrieve data from a unique SET column. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3677)

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-32:01 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation     consisting of a server daemon (mysqld) and many different client programs and libraries. The base package     contains the MySQL client programs, the client shared libraries, and generic MySQL files.
    Security issues fixed with this release:
    CVE-2010-3677     Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial     of service (mysqld daemon crash) via a join query that uses a table with a unique SET column.
    CVE-2010-3678     Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (crash) via     (1) IN or (2) CASE operations with NULL arguments that are explicitly specified or indirectly provided by     the WITH ROLLUP modifier.
    CVE-2010-3679     Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld     daemon crash) via certain arguments to the BINLOG command, which triggers an access of uninitialized     memory, as demonstrated by valgrind.
    CVE-2010-3680     Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld     daemon crash) by creating temporary tables with nullable columns while using InnoDB, which triggers an     assertion failure.
    CVE-2010-3681     Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 allows remote authenticated users to cause a denial of     service (mysqld daemon crash) by using the HANDLER interface and performing 'alternate reads from two     indexes on a table,' which triggers an assertion failure.
    CVE-2010-3682     Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial     of service (mysqld daemon crash) by using EXPLAIN with crafted 'SELECT ... UNION ... ORDER BY (SELECT ...
    WHERE ...)' statements, which triggers a NULL pointer dereference in the Item_singlerow_subselect::store     function.
    CVE-2010-3683     Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 sends an OK packet when a LOAD DATA INFILE request     generates SQL errors, which allows remote authenticated users to cause a denial of service (mysqld daemon     crash) via a crafted request.
    CVE-2010-3833     MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 does not properly propagate type errors,     which allows remote attackers to cause a denial of service (server crash) via crafted arguments to     extreme-value functions such as (1) LEAST and (2) GREATEST, related to KILL_BAD_DATA and a 'CREATE TABLE     ... SELECT.'     CVE-2010-3835     MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of     service (mysqld server crash) by performing a user-variable assignment in a logical expression that is     calculated and stored in a temporary table for GROUP BY, then causing the expression value to be used     after the table is created, which causes the expression to be re-evaluated instead of accessing its value     from the table.
    CVE-2010-3836     MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to     cause a denial of service (assertion failure and server crash) via vectors related to view preparation,     pre-evaluation of LIKE predicates, and IN Optimizers.
    CVE-2010-3837     MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to     cause a denial of service (server crash) via a prepared statement that uses GROUP_CONCAT with the WITH     ROLLUP modifier, probably triggering a use-after-free error when a copied object is modified in a way that     also affects the original object.
    CVE-2010-3838     MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to     cause a denial of service (server crash) via a query that uses the (1) GREATEST or (2) LEAST function with     a mixed list of numeric and LONGBLOB arguments, which is not properly handled when the function's result     is 'processed using an intermediate temporary table.'     CVE-2010-3839     MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of     service (infinite loop) via multiple invocations of a (1) prepared statement or (2) stored procedure that     creates a query with nested JOIN statements.
    CVE-2010-3840     The Gis_line_string::init_from_wkb function in sql/spatial.cc in MySQL 5.1 before 5.1.51 allows remote     authenticated users to cause a denial of service (server crash) by calling the PolyFromWKB function with     Well-Known Binary (WKB) data containing a crafted number of (1) line strings or (2) line points.
    These updated packages upgrade MySQL to version 5.1.52. Refer to the MySQL release notes for a full list     of changes:
    <A HREF=http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html>http://dev.mysql...

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This mysql update fixes the following security issues

  - CVE-2010-3833: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3834: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Insufficient Information     (CWE-noinfo)

  - CVE-2010-3835: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Numeric Errors (CWE-189)

  - CVE-2010-3836: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3837: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3838: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Other (CWE-Other)

  - CVE-2010-3839: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Design Error     (CWE-DesignError)

  - CVE-2010-3840: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Other (CWE-Other)

The version of MySQL installed on the remote host is older than 5.0.92.  As such, it reportedly is prone to multiple denial of service attacks :

  - The improper handling of type errors during argument     evaluation in extreme-value functions, e.g., 'LEAST()'     or 'GREATEST()' causes server crashes. (CVE-2010-3833)

  - Remote authenticated attackers could crash the server.
    (CVE-2010-3834 & CVE-2010-3836)

  - The use of 'GROUP_CONCAT()' and 'WITH ROLLUP' caused     server crashes. (CVE-2010-3837)

  - The use of an intermediate temporary table and queries     containing calls to 'GREATEST()' or 'LEAST()', having     a list of both numeric and 'LONGBLOB' arguments, caused     server crashes. (CVE-2010-3838)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
57115	SuSE 11.1 Security Update : MySQL (SAT Patch Number 5285)	Nessus	SuSE Local Security Checks	2011/12/13	2021/1/19	medium
75590	openSUSE Security Update : libmysqlclusterclient16 (openSUSE-SU-2011:0774-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
50534	Mandriva Linux Security Advisory : mysql (MDVSA-2010:223)	Nessus	Mandriva Local Security Checks	2010/11/10	2021/1/6	medium
60884	Scientific Linux Security Update : mysql on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
284205	MiracleLinux 4 : mysql-5.1.52-1.AXS4.1 (AXSA:2011-32:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	medium
75589	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2011:1250-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
75904	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2011:1250-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
17834	MySQL < 5.0.92 Multiple Denial of Service	Nessus	Databases	2012/1/18	2018/11/15	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

medium