MariaDB Multiple Vulnerabilities

SA52015

CVE-2012-0572, CVE-2012-0574, CVE-2012-0578, CVE-2012-1702, CVE-2012-1705, CVE-2012-5060, CVE-2012-5096, CVE-2012-5611, CVE-2012-5612, CVE-2012-5615, CVE-2012-5627, CVE-2013-0367, CVE-2013-0368, CVE-2013-0371, CVE-2013-0375, CVE-2013-0383, CVE-2013-0384, CVE-2013-0385, CVE-2013-0386, CVE-2013-0389

31 Jan 2013

Less Critical

Vendor Patch

MariaDB 5.x

From local network

DoS (Denial of Service)

This includes vulnerabilities ranging from excessive resource consumption (e.g. causing a system to use a lot of memory) to crashing an application or an entire system.

System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Brute force

Used in cases where an application or algorithm allows an attacker to guess passwords in an easy manner.

Exposure of sensitive information

Vulnerabilities where documents or credentials are leaked or can be revealed either locally or from remote.

Manipulation of data

This includes vulnerabilities where a user or a remote attacker can manipulate local data on a system, but not necessarily be able to gain escalated privileges or system access.

The most frequent type of vulnerabilities with this impact are SQL-injection vulnerabilities, where a malicious user or person can manipulate SQL queries.

Multiple vulnerabilities have been reported in MariaDB, which can be exploited by malicious, local users to disclose sensitive information and manipulate data, by malicious users to cause a DoS (Denial of Service), disclose sensitive information, manipulate data, and compromise a vulnerable system, and by malicious people to conduct brute force attacks and cause a DoS (Denial of Service).

1) Some vulnerabilities exist due to vulnerabilities in MySQL.

For more information:
SA51427
SA51894

2) An unspecified error can be exploited to cause a buffer overflow.

3) Some unspecified errors can be exploited to cause crashes and server lockups.

The vulnerabilities are reported in versions prior to 5.5.29.

Update to version 5.5.29.

2, 3) Reported by the vendor.

https://kb.askmonty.org/en/mariadb-5529-release-notes/