MySQL 5

Tenable plugin 118234 flags Oracle MySQL 5.6.41 and earlier, fixed in 5.6.42, for the October 16, 2018 Oracle Critical Patch Update. The bundle covers multiple MySQL Server issues plus an inherited zlib issue (CVE-2016-9843) that drives the scary top-end score. In Oracle's own risk matrix, the MySQL Server issues relevant to 5.6.x are mostly reachable over the MySQL protocol but are not remotely exploitable without authentication, and the 5.6-specific entries trend toward availability impact or limited integrity issues rather than clean unauthenticated takeover.

The vendor-style severity is overstated for enterprise prioritization because the main friction is decisive: in real deployments, an attacker typically needs network reachability to MySQL and valid database credentials before any of these 5.6-server paths matter. That makes this a post-initial-access or credential-compromise amplifier, not a true internet-scale pre-auth edge bug. It still matters—especially for exposed 3306 listeners and legacy estates—but it does not deserve the same urgency as an unauthenticated RCE.

Why this verdict

• Baseline starts high, then falls fast: the plugin inherits a worst-case 9.8 bundle score, but that score is driven by CVE-2016-9843 and does not represent the typical exploit path for the 5.6-specific MySQL Server issues.
• Authentication is the decisive friction: Oracle's October 2018 matrix marks the reviewed MySQL Server entries affecting 5.6.41 and prior as not remotely exploitable without authentication. Requiring DB credentials implies prior compromise, secret theft, or app access.
• Reachable population is narrower than the score implies: many enterprise MySQL servers are not directly internet-facing, so the attacker often also needs internal network position. Internal-only reachability compounds the downgrade because it assumes the attacker is already past the perimeter.
• Public weaponization looks weak: I did not find a mature, widely referenced public exploit chain for the authenticated MySQL 5.6 CPU items. That lowers urgency versus bugs with turnkey Metasploit/Nuclei/one-click exploit coverage.
• Scanner certainty is limited: Tenable says detection is version-only, not exploit-based. That means you should treat this as a strong inventory signal, not proof of reachable exploitable risk on every host.

Why not higher?

This is not higher because the real attack path is usually post-authentication and often post-initial-access. A vulnerability that needs internal reachability plus MySQL credentials is simply not in the same class as an unauthenticated internet-facing RCE, no matter what the inherited top CVSS in the bundle says.

Why not lower?

This is not lower because exposed MySQL services still exist in the wild, and a compromised app or reused DB credential can make exploitation practical. Also, anyone still running MySQL 5.6 is carrying legacy operational risk, so even a downgraded CPU finding should not be hand-waved away.

1. Restrict MySQL reachability — Move listeners behind private subnets, host firewalls, or allowlists so only app tiers and admin jump hosts can reach 3306/TCP. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but for internet-exposed instances do this immediately as standard exposure reduction.
2. Rotate and scope database credentials — Reduce the odds that an attacker can satisfy the main exploit prerequisite by rotating service-account secrets, removing dormant accounts, and cutting grants to least privilege. There is no mitigation SLA for MEDIUM, so fold this into normal credential-hardening work while staying inside the <=365 day remediation window.
3. Validate backports before forcing upgrades — If the host runs a distro-packaged MySQL or a derivative, check vendor advisories and package changelogs before assuming the upstream Oracle version string tells the whole truth. This avoids unnecessary emergency change risk while you remediate within the MEDIUM window.
4. Monitor for direct database access — Alert on new source IPs, unusual DB usernames, brute-force attempts, and interactive logins to production MySQL servers. This does not remove the bug, but it raises the chance you catch the credential-compromise step that usually comes first.

Run this on the target MySQL host or inside the database container/VM. Invoke it as bash verify-mysql-118234.sh with standard user rights if mysqld or mysql is in PATH; root is only needed if you must read restricted process paths. The script checks whether the host matches this specific plugin scope: Oracle MySQL 5.6.x < 5.6.42.

#!/usr/bin/env bash
# verify-mysql-118234.sh
# Determine whether the local host matches Tenable plugin 118234 scope:
# Oracle MySQL 5.6.x prior to 5.6.42
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET_FIXED="5.6.42"

get_version() {
  local out ver

  if command -v mysqld >/dev/null 2>&1; then
    out="$(mysqld --version 2>/dev/null || true)"
    ver="$(printf '%s' "$out" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)"
    if [ -n "${ver:-}" ]; then
      printf '%s' "$ver"
      return 0
    fi
  fi

  if command -v mysql >/dev/null 2>&1; then
    out="$(mysql --version 2>/dev/null || true)"
    ver="$(printf '%s' "$out" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)"
    if [ -n "${ver:-}" ]; then
      printf '%s' "$ver"
      return 0
    fi
  fi

  if command -v mysqladmin >/dev/null 2>&1; then
    out="$(mysqladmin version 2>/dev/null || true)"
    ver="$(printf '%s' "$out" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)"
    if [ -n "${ver:-}" ]; then
      printf '%s' "$ver"
      return 0
    fi
  fi

  return 1
}

version_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ] && [ "$1" != "$2" ]
}

version="$(get_version || true)"

if [ -z "${version:-}" ]; then
  echo "UNKNOWN: could not determine local MySQL version"
  exit 2
fi

major_minor="$(printf '%s' "$version" | cut -d. -f1-2)"

if [ "$major_minor" != "5.6" ]; then
  echo "PATCHED: host is running MySQL $version (not in plugin 118234's 5.6.x scope)"
  exit 0
fi

if version_lt "$version" "$TARGET_FIXED"; then
  echo "VULNERABLE: MySQL $version is older than fixed version $TARGET_FIXED"
  exit 1
fi

echo "PATCHED: MySQL $version is at or above fixed version $TARGET_FIXED"
exit 0

Sources

1. Tenable Nessus Plugin 118234
2. Oracle Critical Patch Update - October 2018
3. MySQL 5.6 Release Notes PDF
4. NVD CVE-2016-9843
5. Ubuntu CVE-2018-3143
6. Red Hat Bugzilla CVE-2018-3143
7. Shadowserver Accessible MySQL Server Report
8. CISA Known Exploited Vulnerabilities Catalog