The remote Solaris system is missing necessary patches to address security updates :

  - MySQL before 5.0.67 allows local users to bypass certain     privilege checks by calling CREATE TABLE on a MyISAM     table with modified (1) DATA DIRECTORY or (2) INDEX     DIRECTORY arguments that are originally associated with     pathnames without symlinks, and that can point to tables     created at a future time at which a pathname is modified     to contain a symlink to a subdirectory of the MySQL home     data directory. NOTE: this vulnerability exists because     of an incomplete fix for CVE-2008-4097. (CVE-2008-4098)

  - sql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x     through 5.1.41, and 6.0 before 6.0.9-alpha, when the     data home directory contains a symlink to a different     filesystem, allows remote authenticated users to bypass     intended access restrictions by calling CREATE TABLE     with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY     argument referring to a subdirectory that requires     following this symlink. (CVE-2008-7247)

  - MySQL before 5.1.46 allows local users to delete the     data and index files of another user's MyISAM table via     a symlink attack in conjunction with the DROP TABLE     command, a different vulnerability than CVE-2008-4098     and CVE-2008-7247. (CVE-2010-1626)

  - MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x     before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL     5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and     earlier allows remote attackers to cause a denial of     service (crash) via a crafted geometry feature that     specifies a large number of points, which is not     properly handled when processing the binary     representation of this feature, related to a numeric     calculation error. (CVE-2013-1861)

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to a new upstream version, 5.5.33, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see the MySQL 5.5 Release Notes for further details :

  -     http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-     32.html
  -     http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-     33.html

In addition this update fixes two issues affecting specifically the mysql-5.5 Debian package :

A race condition in the post-installation script of the mysql-server-5.5 package creates the configuration file '/etc/mysql/debian.cnf' with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as credentials for the debian-sys-maint to perform administration tasks. (CVE-2013-2162 )

Matthias Reichl reported that the mysql-5.5 package misses the patches applied previous in Debian's mysql-5.1 to drop the database 'test' and the permissions that allow anonymous access, without a password, from localhost to the 'test' database and any databases starting with'test_'. This update reintroduces these patches for the mysql-5.5 package.

Existing databases and permissions are not touched. Please refer to the NEWS file provided with this update for further information.

The remote host is affected by the vulnerability described in GLSA-201409-04 (MySQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MySQL. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly gain escalated privileges. A remote       attacker could send a specially crafted SQL query, possibly resulting in       a Denial of Service condition. A remote attacker could entice a user to       connect to specially crafted MySQL server, possibly resulting in       execution of arbitrary code with the privileges of the process.
  Workaround :

    There is no known workaround at this time.

The version of MariaDB installed on the remote host is prior to 10.0.4. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.0.4 advisory.

  - Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote     authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0502)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and     earlier allows remote authenticated users to affect integrity via unknown vectors related to Audit Log.
    (CVE-2013-3809)

  - MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle     MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a     denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is     not properly handled when processing the binary representation of this feature, related to a numeric     calculation error. (CVE-2013-1861)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier allows remote     authenticated users to affect availability via unknown vectors related to Server Parser. (CVE-2013-3783)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and     earlier allows remote authenticated users to affect availability via unknown vectors related to Data     Manipulation Language. (CVE-2013-3793)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL 5.5.x installed on the remote host is prior to 5.5.32. It is, therefore, affected by multiple vulnerabilities in the following components :

  - Audit Log
  - Data Manipulation Language
  - Full Text Search
  - GIS
  - Server : Optimizer
  - Server : Parser
  - Server : Replication

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle     MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a     denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is     not properly handled when processing the binary representation of this feature, related to a numeric     calculation error. (CVE-2013-1861)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of MariaDB installed on the remote host is prior to 5.5.32. It is, therefore, affected by multiple vulnerabilities as referenced in the 5.5.32 advisory.

  - Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote     authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0502)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and     earlier allows remote authenticated users to affect integrity via unknown vectors related to Audit Log.
    (CVE-2013-3809)

  - MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle     MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a     denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is     not properly handled when processing the binary representation of this feature, related to a numeric     calculation error. (CVE-2013-1861)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier allows remote     authenticated users to affect availability via unknown vectors related to Server Parser. (CVE-2013-3783)

  - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and     earlier allows remote authenticated users to affect availability via unknown vectors related to Data     Manipulation Language. (CVE-2013-3793)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
80705	Oracle Solaris Third-Party Patch Update : mysql (multiple_vulnerabilities_in_mysql)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
71474	Debian DSA-2818-1 : mysql-5.5 - several vulnerabilities	Nessus	Debian Local Security Checks	2013/12/17	2021/1/11	medium
77548	GLSA-201409-04 : MySQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2014/9/5	2021/1/6	high
167906	MariaDB 10.0.0 < 10.0.4 Multiple Vulnerabilities	Nessus	Databases	2022/11/18	2026/1/29	medium
68938	MySQL 5.5 < 5.5.32 Multiple Vulnerabilities	Nessus	Databases	2013/7/17	2019/11/27	medium
218000	Linux Distros Unpatched Vulnerability : CVE-2013-1861	Nessus	Misc.	2025/3/4	2026/1/28	high
72373	MariaDB 5.5.0 < 5.5.32 Multiple Vulnerabilities	Nessus	Databases	2014/2/6	2026/1/29	medium

检测

插件搜索

medium

medium

high

medium

medium

high

medium