PMASA-2016-44
Announcement-ID: PMASA-2016-44
Date: 2017-01-24
Summary
Multiple vulnerabilities in setup script
Description
A server-side request forgery vulnerability was reported with the setup script. This flaw can allow an unauthenticated attacker to:
- brute-force passwords of MYSQL servers that allow remote logins.
- brute-force passwords of MYSQL servers behind the firewall where HTTP server that run PMA is placed.
- detect internal hostnames.
- detect opened ports on internal network
Additionally there was a race condition between writing configuration and administrator moving it allowing unauthenticated users to read or alter it.
Severity
We consider this vulnerability to be critical.
Mitigation factor
Removal of setup directory after initial setup as described in our documentation avoids this problem.
Affected Versions
All 4.6.x versions (prior to 4.6.6), 4.4.x versions (prior to 4.4.15.10), and 4.0.x versions (prior to 4.0.10.19) are affected
Solution
Upgrade to phpMyAdmin 4.6.6, 4.4.15.10, or 4.0.10.19 or newer or apply patch listed below.
References
Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability.
Assigned CVE IDs: CVE-2016-6621
CWE IDs: CWE-661
Patches
The following commits have been made on the 4.6 branch to fix this issue:
The following commits have been made on the 4.4 branch to fix this issue:
The following commits have been made on the 4.0 branch to fix this issue:
More information
For further information and in case of questions, please contact the phpMyAdmin security team at security@phpmyadmin.net.