Debian LTS Advisory ([SECURITY] [DLA 1488-1] mariadb-10.0 security update)

Published: 2018-09-02 22:00:00
CVE Author: NIST National Vulnerability Database

CVSS Base Vector:
AV:N/AC:L/Au:S/C:N/I:P/A:P

Solution Type:
Vendor Patch

Detection Type:
Linux Distribution Package

Affected Versions:
mariadb-10.0 on Debian Linux

Recommendations:
For Debian 8 'Jessie', these problems have been fixed in version 10.0.36-0+deb8u1. We recommend that you upgrade your mariadb-10.0 Linux Distribution Packages.

Summary:
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.36. CVE-2018-3058 Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVE-2018-3063 Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVE-2018-3064 Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVE-2018-3066 Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data.

Detection Method:
This check tests the installed software version using the apt Linux Distribution Package manager.

NIST (National Institute of Standards and Technology) NVD (National Vulnerability Database)

https://nvd.nist.gov/vuln/detail/CVE-2018-3058
https://nvd.nist.gov/vuln/detail/CVE-2018-3063
https://nvd.nist.gov/vuln/detail/CVE-2018-3064
https://nvd.nist.gov/vuln/detail/CVE-2018-3066

CVE Analysis

https://www.mageni.net/cve/CVE-2018-3058
https://www.mageni.net/cve/CVE-2018-3063
https://www.mageni.net/cve/CVE-2018-3064
https://www.mageni.net/cve/CVE-2018-3066

References:

https://lists.debian.org/debian-lts-announce/2018/08/msg00036.html

Severity
Medium
CVSS Score
5.5
Published
2018-09-02
Modified
2019-03-18
Category
Debian Local Security Checks

You never have to pay for a vulnerability scanning and management software again.

Tired of paying a subscription 'per asset' or 'per IP'? Well you can officially cancel your current subscription. Mageni provides a free, open source and enterprise-ready vulnerability scanning and management platform which helps you to find, prioritize, remediate and manage your vulnerabilities. It is free and always will be.