Detections
Analytics

MariaDB 5.5.43 < 5.5.44 'ADD INDEX' Statement DoS

medium Nessus Plugin ID 84798

Language:

Synopsis

The remote database server is affected by a denial of service vulnerability.

Description

The version of MariaDB running on the remote host is 5.5.43 prior to 5.5.44. It is, therefore, affected by a denial of service vulnerability due to an unspecified flaw that exists in file sql_parse.cc. A remote, authenticated attacker can exploit this, via a crafted ADD INDEX statement, to crash the database.

Solution

Upgrade to MariaDB version 5.5.44 or later.

See Also

https://mariadb.org/mariadb-5-5-44-now-available/

https://mariadb.atlassian.net/browse/MDEV-8166

Plugin Details

Severity: Medium

ID: 84798

File Name: mariadb_5_5_44.nasl

Version: 1.8

Type: remote

Family: Databases

Published: 7/16/2015

Updated: 11/18/2022

Configuration: Enable paranoid mode

Supported Sensors: Frictionless Assessment Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2015-3152

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:mariadb:mariadb

Required KB Items: Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 6/11/2015

Vulnerability Publication Date: 5/15/2015

Reference Information

CVE: CVE-2015-2582, CVE-2015-2620, CVE-2015-2643, CVE-2015-2648, CVE-2015-3152, CVE-2015-4752, CVE-2015-4864