MariaDB DoS Vulnerability (MDEV-32082)

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:mariadb:mariadb";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.125170");
  script_version("2025-11-28T15:41:52+0000");
  script_tag(name:"last_modification", value:"2025-11-28 15:41:52 +0000 (Fri, 28 Nov 2025)");
  script_tag(name:"creation_date", value:"2025-03-13 08:09:48 +0000 (Thu, 13 Mar 2025)");
  script_tag(name:"cvss_base", value:"6.1");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:M/C:N/I:N/A:C");

  script_cve_id("CVE-2023-52968");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("MariaDB DoS Vulnerability (MDEV-32082)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Databases");
  script_dependencies("gb_mysql_mariadb_remote_detect.nasl");
  script_mandatory_keys("mariadb/detected");

  script_tag(name:"summary", value:"MariaDB is prone to a denial of service (DoS) vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"MariaDB Server calls fix_fields_if_needed under
  mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash.");

  script_tag(name:"affected", value:"MariaDB versions prior to 10.4.33, 10.5.x prior to 10.5.24,
  10.6.x prior to 10.6.17, 10.7.x prior to 10.11.7, 11.0.x prior to 11.0.5, 11.1.x prior to 11.1.4,
  11.2.x prior to 11.2.3, 11.3.x  prior to 11.3.2 and 11.4.x prior to 11.4.1.");

  script_tag(name:"solution", value:"Update to version 10.4.33, 10.5.24, 10.6.17, 10.11.7, 11.0.5,
  11.1.4, 11.2.3, 11.3.2, 11.4.1 or later.");

  script_xref(name:"URL", value:"https://jira.mariadb.org/browse/MDEV-32082");
  script_xref(name:"URL", value:"https://mariadb.com/kb/en/mariadb-10-4-33-release-notes/");
  script_xref(name:"URL", value:"https://mariadb.com/kb/en/mariadb-10-5-24-release-notes/");
  script_xref(name:"URL", value:"https://mariadb.com/kb/en/mariadb-10-6-17-release-notes/");
  script_xref(name:"URL", value:"https://mariadb.com/kb/en/mariadb-10-11-7-release-notes/");
  script_xref(name:"URL", value:"https://mariadb.com/kb/en/mariadb-11-0-5-release-notes/");
  script_xref(name:"URL", value:"https://mariadb.com/kb/en/mariadb-11-1-4-release-notes/");
  script_xref(name:"URL", value:"https://mariadb.com/kb/en/mariadb-11-2-3-release-notes/");
  script_xref(name:"URL", value:"https://mariadb.com/kb/en/mariadb-11-3-2-release-notes/");
  script_xref(name:"URL", value:"https://mariadb.com/kb/en/mariadb-11-4-1-release-notes/");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (!port = get_app_port(cpe: CPE))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_is_less(version: version, test_version: "10.4.33")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "10.4.33", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "10.5.0", test_version_up: "10.5.24")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "10.5.24", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "10.6.0", test_version_up: "10.6.17")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "10.6.17", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "10.7.0", test_version_up: "10.11.7")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "10.11.7", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "11.0.0", test_version_up: "11.0.5")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "11.0.5", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "11.1.0", test_version_up: "11.1.4")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "11.1.4", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "11.2.0", test_version_up: "11.2.3")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "11.2.3", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "11.3.0", test_version_up: "11.3.2")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "11.3.2", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "11.4.0", test_version_up: "11.4.1")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "11.4.1", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);