MariaDB 3.4.0 < 3.4.10

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(343489);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/15");

  script_name(english:"MariaDB 3.4.0 < 3.4.10");

  script_set_attribute(attribute:"synopsis", value:
"The remote database server is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of MariaDB installed on the remote host is prior to 3.4.10. It is, therefore, affected by a vulnerability as
referenced in the GHSA-fmq9-qjxj-qpf7 advisory.

  - ### Impact  In the Zero-Configuration SSL protocol, the MariaDB client must refuse sending clear-text
    password over unverified TLS connection. Because of a programming mistake, MariaDB Connector/C
    (libmariadb) could have switched to a clear-text password plugin if the TLS certificate was valid, but did
    not belong to the connecting host. This allowed an active man-in-the-middle attacker to replace the
    certificate to another valid certificate and request the client to switch to the clear-text password
    plugin. Only MariaDB Connector/C is affected, other MariaDB connectors are safe.    ### Workarounds  Any
    of the below can be used as mitigation  * install properly signed certificates on the server  * configure
    the client to accept only specific certificate fingerprints  * delete `mysql_clear_password.so` and
    `dialog.so` files  * use `restricted-auth` option to restrict authentication to safe subset of plugins
    ### References  https://jira.mariadb.org/browse/CONC-846    ### Credits  Aisle Research  RedHat (GHSA-
    fmq9-qjxj-qpf7)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?365d11e4");
  script_set_attribute(attribute:"solution", value:
"Upgrade to MariaDB version 3.4.10 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(297);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/07");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:mariadb:mariadb");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("mysql_version.nasl", "mysql_login.nasl", "mariadb_nix_installed.nbin", "mariadb_win_installed.nbin");
  script_require_keys("installed_sw/MariaDB");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::combined_get_app_info(app:'MariaDB');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  { 'min_version' : '3.4.1–3.4.9', 'fixed_version' : '3.4.10' }
];
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    require_paranoia:TRUE,
    severity:SECURITY_HOLE
);