The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2010-485:04 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation     consisting of a server daemon (mysqld) and many different client programs and libraries. The base package     contains the MySQL client programs, the client shared libraries, and generic MySQL files.
    Security issues fixed with this release:
    CVE-2010-3677     CVE-2010-3680     CVE-2010-3681     CVE-2010-3682     CVE-2010-3833     CVE-2010-3835     CVE-2010-3836     CVE-2010-3837     CVE-2010-3838     CVE-2010-3839     CVE-2010-3840     No information available at the time of writing, please see the CVE links below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL Community Server installed on the remote host is earlier than 5.1.51 and is, therefore, potentially affected by multiple vulnerabilities:

  - A privilege escalation vulnerability exists when using     statement-based replication. Version specific comments     used on a master server with a lesser release version     than its slave can allow the MySQL privilege system on     the slave server to be subverted. (49124)

  - An authenticated user can crash the MySQL server by     passing improper WKB to the 'PolyFromWKB()' function.
    (51875)

  - The improper handling of type errors during argument     evaluation in extreme-value functions, e.g., 'LEAST()'     or 'GREATEST()' caused server crashes. (55826)

  - The creation of derived tables needing a temporary     grouping table caused server crashes. (55568)

  - The re-evaluation of a user-variable assignment     expression after the creation of a temporary table     caused server crashes. (55564)

  - The 'convert_tz()' function can be used to crash the     server by setting the timezone argument to an empty     SET column value. (55424)

  - The pre-evaluation of 'LIKE' predicates while preparing     a view caused server crashes. (54568)

  - The use of 'GROUP_CONCAT()' and 'WITH ROLLUP' caused     server crashes. (54476)

  - The use of an intermediate temporary table and queries     containing calls to 'GREATEST()' or 'LEAST()', having     a list of both numeric and 'LONGBLOB' arguments, caused     server crashes. (54461)

  - The use of nested joins in prepared statements or     stored procedures could result in infinite loops.
    (53544)

Several vulnerabilities have been discovered in the MySQL database server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-3677     It was discovered that MySQL allows remote authenticated     users to cause a denial of service (mysqld daemon crash)     via a join query that uses a table with a unique SET     column.

  - CVE-2010-3680     It was discovered that MySQL allows remote authenticated     users to cause a denial of service (mysqld daemon crash)     by creating temporary tables while using InnoDB, which     triggers an assertion failure.

  - CVE-2010-3681     It was discovered that MySQL allows remote authenticated     users to cause a denial of service (mysqld daemon crash)     by using the HANDLER interface and performing 'alternate     reads from two indexes on a table,' which triggers an     assertion failure.

  - CVE-2010-3682     It was discovered that MySQL incorrectly handled use of     EXPLAIN with certain queries. An authenticated user     could crash the server.

  - CVE-2010-3833     It was discovered that MySQL incorrectly handled     propagation during evaluation of arguments to     extreme-value functions. An authenticated user could     crash the server.

  - CVE-2010-3834     It was discovered that MySQL incorrectly handled     materializing a derived table that required a temporary     table for grouping. An authenticated user could crash     the server.

  - CVE-2010-3835     It was discovered that MySQL incorrectly handled certain     user-variable assignment expressions that are evaluated     in a logical expression context. An authenticated user     could crash the server.

  - CVE-2010-3836     It was discovered that MySQL incorrectly handled     pre-evaluation of LIKE predicates during view     preparation. An authenticated user could crash the     server.

  - CVE-2010-3837     It was discovered that MySQL incorrectly handled using     GROUP_CONCAT() and WITH ROLLUP together. An     authenticated user could crash the server.

  - CVE-2010-3838     It was discovered that MySQL incorrectly handled certain     queries using a mixed list of numeric and LONGBLOB     arguments to the GREATEST() or LEAST() functions. An     authenticated user could crash the server.

  - CVE-2010-3840     It was discovered that MySQL incorrectly handled     improper WKB data passed to the PolyFromWKB() function.
    An authenticated user could crash the server.

Updated mysql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

It was found that the MySQL PolyFromWKB() function did not sanity check Well-Known Binary (WKB) data. A remote, authenticated attacker could use specially crafted WKB data to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3840)

A flaw was found in the way MySQL processed certain JOIN queries. If a stored procedure contained JOIN queries, and that procedure was executed twice in sequence, it could cause an infinite loop, leading to excessive CPU use (up to 100%). A remote, authenticated attacker could use this flaw to cause a denial of service. (CVE-2010-3839)

A flaw was found in the way MySQL processed queries that provide a mixture of numeric and longblob data types to the LEAST or GREATEST function. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3838)

A flaw was found in the way MySQL processed PREPARE statements containing both GROUP_CONCAT and the WITH ROLLUP modifier. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3837)

It was found that MySQL did not properly pre-evaluate LIKE arguments in view prepare mode. A remote, authenticated attacker could possibly use this flaw to crash mysqld. (CVE-2010-3836)

A flaw was found in the way MySQL processed statements that assign a value to a user-defined variable and that also contain a logical value evaluation. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3835)

A flaw was found in the way MySQL evaluated the arguments of extreme-value functions, such as LEAST and GREATEST. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3833)

A flaw was found in the way MySQL processed EXPLAIN statements for some complex SELECT queries. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3682)

A flaw was found in the way MySQL processed certain alternating READ requests provided by HANDLER statements. A remote, authenticated attacker could use this flaw to provide such requests, causing mysqld to crash. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3681)

A flaw was found in the way MySQL processed CREATE TEMPORARY TABLE statements that define NULL columns when using the InnoDB storage engine. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3680)

A flaw was found in the way MySQL processed JOIN queries that attempt to retrieve data from a unique SET column. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3677)

All MySQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2011-004 applied. This update contains security- related fixes for the following components :

  - AirPort
  - App Store
  - ColorSync
  - CoreGraphics
  - ImageIO
  - Libsystem
  - libxslt
  - MySQL
  - patch
  - Samba
  - servermgrd
  - subversion

This MySQL version update to 5.0.94 update fixes the following security issues :

  - CVE-2010-3833: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3834: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Insufficient Information     (CWE-noinfo)

  - CVE-2010-3835: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Numeric Errors (CWE-189)

  - CVE-2010-3836: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3837: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-3838: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Other (CWE-Other)

  - CVE-2010-3839: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Design Error     (CWE-DesignError)

  - CVE-2010-3840: CVSS v2 Base Score: 4.0 (moderate)     (AV:N/AC:L/Au:S/C:N/I:N/A:P): Other (CWE-Other)

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.1.61 in Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. Ubuntu 8.04 LTS has been updated to MySQL 5.0.95.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information :

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.ht ml.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The MySQL PolyFromWKB() function did not sanity check Well-Known Binary (WKB) data, which could allow a remote, authenticated attacker to crash mysqld. (CVE-2010-3840)

A flaw in the way MySQL processed certain JOIN queries could allow a remote, authenticated attacker to cause excessive CPU use (up to 100%), if a stored procedure contained JOIN queries, and that procedure was executed twice in sequence. (CVE-2010-3839)

A flaw in the way MySQL processed queries that provide a mixture of numeric and longblob data types to the LEAST or GREATEST function, could allow a remote, authenticated attacker to crash mysqld.
(CVE-2010-3838)

A flaw in the way MySQL processed PREPARE statements containing both GROUP_CONCAT and the WITH ROLLUP modifier could allow a remote, authenticated attacker to crash mysqld. (CVE-2010-3837)

MySQL did not properly pre-evaluate LIKE arguments in view prepare mode, possibly allowing a remote, authenticated attacker to crash mysqld. (CVE-2010-3836)

A flaw in the way MySQL processed statements that assign a value to a user-defined variable and that also contain a logical value evaluation could allow a remote, authenticated attacker to crash mysqld.
(CVE-2010-3835)

A flaw in the way MySQL evaluated the arguments of extreme-value functions, such as LEAST and GREATEST, could allow a remote, authenticated attacker to crash mysqld. (CVE-2010-3833)

A flaw in the way MySQL handled LOAD DATA INFILE requests allowed MySQL to send OK packets even when there were errors. (CVE-2010-3683)

A flaw in the way MySQL processed EXPLAIN statements for some complex SELECT queries could allow a remote, authenticated attacker to crash mysqld. (CVE-2010-3682)

A flaw in the way MySQL processed certain alternating READ requests provided by HANDLER statements could allow a remote, authenticated attacker to crash mysqld. (CVE-2010-3681)

A flaw in the way MySQL processed CREATE TEMPORARY TABLE statements that define NULL columns when using the InnoDB storage engine, could allow a remote, authenticated attacker to crash mysqld.
(CVE-2010-3680)

A flaw in the way MySQL processed certain values provided to the BINLOG statement caused MySQL to read unassigned memory. A remote, authenticated attacker could possibly use this flaw to crash mysqld.
(CVE-2010-3679)

A flaw in the way MySQL processed SQL queries containing IN or CASE statements, when a NULL argument was provided as one of the arguments to the query, could allow a remote, authenticated attacker to crash mysqld. (CVE-2010-3678)

A flaw in the way MySQL processed JOIN queries that attempt to retrieve data from a unique SET column could allow a remote, authenticated attacker to crash mysqld. (CVE-2010-3677)

Note: CVE-2010-3840, CVE-2010-3838, CVE-2010-3837, CVE-2010-3835, CVE-2010-3833, CVE-2010-3682, CVE-2010-3681, CVE-2010-3680, CVE-2010-3678, and CVE-2010-3677 only cause a temporary denial of service, as mysqld was automatically restarted after each crash.

These updated packages upgrade MySQL to version 5.1.52. Refer to the MySQL release notes for a full list of changes :

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
283959	MiracleLinux 3 : mysql-5.0.77-4.4.0.1.AXS3 (AXSA:2010-485:04)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	medium
49711	MySQL Community Server < 5.1.51 Multiple Vulnerabilities	Nessus	Databases	2010/10/5	2018/11/15	medium
51530	Debian DSA-2143-1 : mysql-dfsg-5.0 - several vulnerabilities	Nessus	Debian Local Security Checks	2011/1/17	2021/1/4	medium
50806	CentOS 5 : mysql (CESA-2010:0825)	Nessus	CentOS Local Security Checks	2010/11/24	2021/1/4	medium
55415	Mac OS X Multiple Vulnerabilities (Security Update 2011-004)	Nessus	MacOS X Local Security Checks	2011/6/24	2024/5/28	high
57115	SuSE 11.1 Security Update : MySQL (SAT Patch Number 5285)	Nessus	SuSE Local Security Checks	2011/12/13	2021/1/19	medium
58325	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1397-1)	Nessus	Ubuntu Local Security Checks	2012/3/13	2019/9/19	high
60940	Scientific Linux Security Update : mysql on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium

検出

プラグインの検索

medium

medium

medium

medium

high

medium

high

medium