English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

MariaDB Multiple Vulnerabilities


Secunia ID

SA52015

CVE-ID

CVE-2012-0572, CVE-2012-0574, CVE-2012-0578, CVE-2012-1702, CVE-2012-1705, CVE-2012-5060, CVE-2012-5096, CVE-2012-5611, CVE-2012-5612, CVE-2012-5615, CVE-2012-5627, CVE-2013-0367, CVE-2013-0368, CVE-2013-0371, CVE-2013-0375, CVE-2013-0383, CVE-2013-0384, CVE-2013-0385, CVE-2013-0386, CVE-2013-0389

Release Date

31 Jan 2013

Criticality

Less Critical

Solution Status

Vendor Patch

Software

MariaDB 5.x

Where

From local network

Impact
DoS (Denial of Service)

This includes vulnerabilities ranging from excessive resource consumption (e.g. causing a system to use a lot of memory) to crashing an application or an entire system.

System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Brute force

Used in cases where an application or algorithm allows an attacker to guess passwords in an easy manner.

Exposure of sensitive information

Vulnerabilities where documents or credentials are leaked or can be revealed either locally or from remote.

Manipulation of data

This includes vulnerabilities where a user or a remote attacker can manipulate local data on a system, but not necessarily be able to gain escalated privileges or system access.

The most frequent type of vulnerabilities with this impact are SQL-injection vulnerabilities, where a malicious user or person can manipulate SQL queries.

Description

Multiple vulnerabilities have been reported in MariaDB, which can be exploited by malicious, local users to disclose sensitive information and manipulate data, by malicious users to cause a DoS (Denial of Service), disclose sensitive information, manipulate data, and compromise a vulnerable system, and by malicious people to conduct brute force attacks and cause a DoS (Denial of Service).

1) Some vulnerabilities exist due to vulnerabilities in MySQL.

For more information:
SA51427
SA51894

2) An unspecified error can be exploited to cause a buffer overflow.

3) Some unspecified errors can be exploited to cause crashes and server lockups.

The vulnerabilities are reported in versions prior to 5.5.29.

Solution

Update to version 5.5.29.

Reported by

2, 3) Reported by the vendor.

Original Advisory

https://kb.askmonty.org/en/mariadb-5529-release-notes/