From Red Hat Security Advisory 2016:1602 :
An update for mariadb is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.
The following packages have been upgraded to a newer upstream version:
mariadb (5.5.50).
Security Fix(es) :
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory RHSA-2016:1602 and
# Oracle Linux Security Advisory ELSA-2016-1602 respectively.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(92934);
script_version("2.9");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/14");
script_cve_id("CVE-2016-0640", "CVE-2016-0641", "CVE-2016-0643", "CVE-2016-0644", "CVE-2016-0646", "CVE-2016-0647", "CVE-2016-0648", "CVE-2016-0649", "CVE-2016-0650", "CVE-2016-0666", "CVE-2016-3452", "CVE-2016-3477", "CVE-2016-3521", "CVE-2016-3615", "CVE-2016-5440", "CVE-2016-5444");
script_xref(name:"RHSA", value:"2016:1602");
script_name(english:"Oracle Linux 7 : mariadb (ELSA-2016-1602)");
script_summary(english:"Checks rpm output for the updated packages");
script_set_attribute(
attribute:"synopsis",
value:"The remote Oracle Linux host is missing one or more security updates."
);
script_set_attribute(
attribute:"description",
value:
"From Red Hat Security Advisory 2016:1602 :
An update for mariadb is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security
impact of Important. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.
MariaDB is a multi-user, multi-threaded SQL database server that is
binary compatible with MySQL.
The following packages have been upgraded to a newer upstream version:
mariadb (5.5.50).
Security Fix(es) :
* This update fixes several vulnerabilities in the MariaDB database
server. Information about these flaws can be found on the Oracle
Critical Patch Update Advisory pages, listed in the References
section. (CVE-2016-0640, CVE-2016-0641, CVE-2016-0643, CVE-2016-0644,
CVE-2016-0646, CVE-2016-0647, CVE-2016-0648, CVE-2016-0649,
CVE-2016-0650, CVE-2016-0666, CVE-2016-3452, CVE-2016-3477,
CVE-2016-3521, CVE-2016-3615, CVE-2016-5440, CVE-2016-5444)"
);
script_set_attribute(
attribute:"see_also",
value:"https://oss.oracle.com/pipermail/el-errata/2016-August/006267.html"
);
script_set_attribute(
attribute:"solution",
value:"Update the affected mariadb packages."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mariadb");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mariadb-bench");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mariadb-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mariadb-embedded");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mariadb-embedded-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mariadb-libs");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mariadb-server");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:mariadb-test");
script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:7");
script_set_attribute(attribute:"vuln_publication_date", value:"2016/04/21");
script_set_attribute(attribute:"patch_publication_date", value:"2016/08/11");
script_set_attribute(attribute:"plugin_publication_date", value:"2016/08/12");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"Oracle Linux Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
os_ver = os_ver[1];
if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 7", "Oracle Linux " + os_ver);
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);
flag = 0;
if (rpm_check(release:"EL7", cpu:"x86_64", reference:"mariadb-5.5.50-1.el7_2")) flag++;
if (rpm_check(release:"EL7", cpu:"x86_64", reference:"mariadb-bench-5.5.50-1.el7_2")) flag++;
if (rpm_check(release:"EL7", cpu:"x86_64", reference:"mariadb-devel-5.5.50-1.el7_2")) flag++;
if (rpm_check(release:"EL7", cpu:"x86_64", reference:"mariadb-embedded-5.5.50-1.el7_2")) flag++;
if (rpm_check(release:"EL7", cpu:"x86_64", reference:"mariadb-embedded-devel-5.5.50-1.el7_2")) flag++;
if (rpm_check(release:"EL7", cpu:"x86_64", reference:"mariadb-libs-5.5.50-1.el7_2")) flag++;
if (rpm_check(release:"EL7", cpu:"x86_64", reference:"mariadb-server-5.5.50-1.el7_2")) flag++;
if (rpm_check(release:"EL7", cpu:"x86_64", reference:"mariadb-test-5.5.50-1.el7_2")) flag++;
if (flag)
{
if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
else security_warning(0);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mariadb / mariadb-bench / mariadb-devel / mariadb-embedded / etc");
}
Vendor | Product | Version | CPE |
---|---|---|---|
oracle | linux | mariadb | p-cpe:/a:oracle:linux:mariadb |
oracle | linux | mariadb-bench | p-cpe:/a:oracle:linux:mariadb-bench |
oracle | linux | mariadb-devel | p-cpe:/a:oracle:linux:mariadb-devel |
oracle | linux | mariadb-embedded | p-cpe:/a:oracle:linux:mariadb-embedded |
oracle | linux | mariadb-embedded-devel | p-cpe:/a:oracle:linux:mariadb-embedded-devel |
oracle | linux | mariadb-libs | p-cpe:/a:oracle:linux:mariadb-libs |
oracle | linux | mariadb-server | p-cpe:/a:oracle:linux:mariadb-server |
oracle | linux | mariadb-test | p-cpe:/a:oracle:linux:mariadb-test |
oracle | linux | 7 | cpe:/o:oracle:linux:7 |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0640
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0641
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0643
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0644
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0646
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0647
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0648
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0649
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0650
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0666
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3452
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3477
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3521
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3615
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5440
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5444
oss.oracle.com/pipermail/el-errata/2016-August/006267.html