The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2011-004 applied. This update contains security- related fixes for the following components :

  - AirPort
  - App Store
  - ColorSync
  - CoreGraphics
  - ImageIO
  - Libsystem
  - libxslt
  - MySQL
  - patch
  - Samba
  - servermgrd
  - subversion

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.1.61 in Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. Ubuntu 8.04 LTS has been updated to MySQL 5.0.95.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information :

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.ht ml.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL Community Server installed on the remote host is earlier than 5.1.51 and is, therefore, potentially affected by multiple vulnerabilities:

  - A privilege escalation vulnerability exists when using     statement-based replication. Version specific comments     used on a master server with a lesser release version     than its slave can allow the MySQL privilege system on     the slave server to be subverted. (49124)

  - An authenticated user can crash the MySQL server by     passing improper WKB to the 'PolyFromWKB()' function.
    (51875)

  - The improper handling of type errors during argument     evaluation in extreme-value functions, e.g., 'LEAST()'     or 'GREATEST()' caused server crashes. (55826)

  - The creation of derived tables needing a temporary     grouping table caused server crashes. (55568)

  - The re-evaluation of a user-variable assignment     expression after the creation of a temporary table     caused server crashes. (55564)

  - The 'convert_tz()' function can be used to crash the     server by setting the timezone argument to an empty     SET column value. (55424)

  - The pre-evaluation of 'LIKE' predicates while preparing     a view caused server crashes. (54568)

  - The use of 'GROUP_CONCAT()' and 'WITH ROLLUP' caused     server crashes. (54476)

  - The use of an intermediate temporary table and queries     containing calls to 'GREATEST()' or 'LEAST()', having     a list of both numeric and 'LONGBLOB' arguments, caused     server crashes. (54461)

  - The use of nested joins in prepared statements or     stored procedures could result in infinite loops.
    (53544)

Several vulnerabilities have been discovered in the MySQL database server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-3677     It was discovered that MySQL allows remote authenticated     users to cause a denial of service (mysqld daemon crash)     via a join query that uses a table with a unique SET     column.

  - CVE-2010-3680     It was discovered that MySQL allows remote authenticated     users to cause a denial of service (mysqld daemon crash)     by creating temporary tables while using InnoDB, which     triggers an assertion failure.

  - CVE-2010-3681     It was discovered that MySQL allows remote authenticated     users to cause a denial of service (mysqld daemon crash)     by using the HANDLER interface and performing 'alternate     reads from two indexes on a table,' which triggers an     assertion failure.

  - CVE-2010-3682     It was discovered that MySQL incorrectly handled use of     EXPLAIN with certain queries. An authenticated user     could crash the server.

  - CVE-2010-3833     It was discovered that MySQL incorrectly handled     propagation during evaluation of arguments to     extreme-value functions. An authenticated user could     crash the server.

  - CVE-2010-3834     It was discovered that MySQL incorrectly handled     materializing a derived table that required a temporary     table for grouping. An authenticated user could crash     the server.

  - CVE-2010-3835     It was discovered that MySQL incorrectly handled certain     user-variable assignment expressions that are evaluated     in a logical expression context. An authenticated user     could crash the server.

  - CVE-2010-3836     It was discovered that MySQL incorrectly handled     pre-evaluation of LIKE predicates during view     preparation. An authenticated user could crash the     server.

  - CVE-2010-3837     It was discovered that MySQL incorrectly handled using     GROUP_CONCAT() and WITH ROLLUP together. An     authenticated user could crash the server.

  - CVE-2010-3838     It was discovered that MySQL incorrectly handled certain     queries using a mixed list of numeric and LONGBLOB     arguments to the GREATEST() or LEAST() functions. An     authenticated user could crash the server.

  - CVE-2010-3840     It was discovered that MySQL incorrectly handled     improper WKB data passed to the PolyFromWKB() function.
    An authenticated user could crash the server.

Updated mysql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

It was found that the MySQL PolyFromWKB() function did not sanity check Well-Known Binary (WKB) data. A remote, authenticated attacker could use specially crafted WKB data to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3840)

A flaw was found in the way MySQL processed certain JOIN queries. If a stored procedure contained JOIN queries, and that procedure was executed twice in sequence, it could cause an infinite loop, leading to excessive CPU use (up to 100%). A remote, authenticated attacker could use this flaw to cause a denial of service. (CVE-2010-3839)

A flaw was found in the way MySQL processed queries that provide a mixture of numeric and longblob data types to the LEAST or GREATEST function. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3838)

A flaw was found in the way MySQL processed PREPARE statements containing both GROUP_CONCAT and the WITH ROLLUP modifier. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3837)

It was found that MySQL did not properly pre-evaluate LIKE arguments in view prepare mode. A remote, authenticated attacker could possibly use this flaw to crash mysqld. (CVE-2010-3836)

A flaw was found in the way MySQL processed statements that assign a value to a user-defined variable and that also contain a logical value evaluation. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3835)

A flaw was found in the way MySQL evaluated the arguments of extreme-value functions, such as LEAST and GREATEST. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3833)

A flaw was found in the way MySQL processed EXPLAIN statements for some complex SELECT queries. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3682)

A flaw was found in the way MySQL processed certain alternating READ requests provided by HANDLER statements. A remote, authenticated attacker could use this flaw to provide such requests, causing mysqld to crash. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3681)

A flaw was found in the way MySQL processed CREATE TEMPORARY TABLE statements that define NULL columns when using the InnoDB storage engine. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3680)

A flaw was found in the way MySQL processed JOIN queries that attempt to retrieve data from a unique SET column. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3677)

All MySQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2010-485:04 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation     consisting of a server daemon (mysqld) and many different client programs and libraries. The base package     contains the MySQL client programs, the client shared libraries, and generic MySQL files.
    Security issues fixed with this release:
    CVE-2010-3677     CVE-2010-3680     CVE-2010-3681     CVE-2010-3682     CVE-2010-3833     CVE-2010-3835     CVE-2010-3836     CVE-2010-3837     CVE-2010-3838     CVE-2010-3839     CVE-2010-3840     No information available at the time of writing, please see the CVE links below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were discovered and corrected in mysql :

  - During evaluation of arguments to extreme-value     functions (such as LEAST() and GREATEST()), type errors     did not propagate properly, causing the server to crash     (CVE-2010-3833).

  - The server could crash after materializing a derived     table that required a temporary table for grouping     (CVE-2010-3834).

  - A user-variable assignment expression that is evaluated     in a logical expression context can be precalculated in     a temporary table for GROUP BY. However, when the     expression value is used after creation of the temporary     table, it was re-evaluated, not read from the table and     a server crash resulted (CVE-2010-3835).

  - Pre-evaluation of LIKE predicates during view     preparation could cause a server crash (CVE-2010-3836).

  - GROUP_CONCAT() and WITH ROLLUP together could cause a     server crash (CVE-2010-3837).

  - Queries could cause a server crash if the GREATEST() or     LEAST() function had a mixed list of numeric and     LONGBLOB arguments, and the result of such a function     was processed using an intermediate temporary table     (CVE-2010-3838).

  - Queries with nested joins could cause an infinite loop     in the server when used from stored procedures and     prepared statements (CVE-2010-3839).

  - The PolyFromWKB() function could crash the server when     improper WKB data was passed to the function     (CVE-2010-3840).

The updated packages have been patched to correct these issues.

This update fixes the following security issue :

  - 676974: mysql-cluster: security issues fixed in MySQL     5.1.51

This update also fixes the following non-security issue :

  - 635645: mysql init script fails to start when SELinux is     enabled

ID	名前	製品	ファミリー	公開日	更新日	深刻度
55415	Mac OS X Multiple Vulnerabilities (Security Update 2011-004)	Nessus	MacOS X Local Security Checks	2011/6/24	2024/5/28	high
58325	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1397-1)	Nessus	Ubuntu Local Security Checks	2012/3/13	2019/9/19	high
49711	MySQL Community Server < 5.1.51 Multiple Vulnerabilities	Nessus	Databases	2010/10/5	2018/11/15	medium
51530	Debian DSA-2143-1 : mysql-dfsg-5.0 - several vulnerabilities	Nessus	Debian Local Security Checks	2011/1/17	2021/1/4	medium
50806	CentOS 5 : mysql (CESA-2010:0825)	Nessus	CentOS Local Security Checks	2010/11/24	2021/1/4	medium
283959	MiracleLinux 3 : mysql-5.0.77-4.4.0.1.AXS3 (AXSA:2010-485:04)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	medium
50534	Mandriva Linux Security Advisory : mysql (MDVSA-2010:223)	Nessus	Mandriva Local Security Checks	2010/11/10	2021/1/6	medium
75590	openSUSE Security Update : libmysqlclusterclient16 (openSUSE-SU-2011:0774-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium

検出

プラグインの検索

high

high

medium

medium

medium

medium

medium

medium