AusCERT - ESB-2013.0584 - [Win][UNIX/Linux] phpMyAdmin: Multiple vulnerabilities

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
ESB-2013.0584 - [Win][UNIX/Linux] phpMyAdmin: Multiple vulnerabilities
Date: 26 April 2013

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2013.0584
        Multiple vulnerabilities have been identified in phpMyAdmin
                               26 April 2013

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           phpMyAdmin
Publisher:         phpMyAdmin
Operating System:  UNIX variants (UNIX, Linux, OSX)
                   Windows
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Reduced Security                -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2013-3241 CVE-2013-3240 CVE-2013-3239
                   CVE-2013-3238  

Original Bulletin: 
   http://www.phpmyadmin.net/home_page/security/PMASA-2013-2.php
   http://www.phpmyadmin.net/home_page/security/PMASA-2013-3.php
   http://www.phpmyadmin.net/home_page/security/PMASA-2013-4.php
   http://www.phpmyadmin.net/home_page/security/PMASA-2013-5.php

Comment: This bulletin contains four (4) phpMyAdmin security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

PMASA-2013-2

Announcement-ID: PMASA-2013-2

Date: 2013-04-24
Summary

Remote code execution via preg_replace().
Description

In some PHP versions, the preg_replace() function can be tricked into 
executing arbitrary PHP code on the server. This is done by passing a crafted 
argument as the regular expression, containing a null byte. phpMyAdmin does 
not correctly sanitize an argument passed to preg_replace() when using the 
"Replace table prefix" feature, opening the way to this vulnerability.
Severity

We consider this vulnerability to be serious.
Mitigation factor

This vulnerability can be triggered only by someone who logged in to 
phpMyAdmin, as the usual token protection prevents non-logged-in users to 
access the required form.
Affected Versions

Versions 3.5.x and 4.0.0 (before -rc3) are affected.
Solution

For 3.5.x, upgrade to phpMyAdmin 3.5.8 or newer; for 4.0.x, upgrade to 
4.0.0-rc3 or newer. You can also apply the patches listed below.
References

Thanks to Janek Vind for reporting this issue.

Assigned CVE ids: CVE-2013-3238

CWE ids: CWE-661 CWE-94
Patches

The following commits have been made on the 3.5 branch to fix this issue:

    dedd542cdaf1606ca9aa3f6f8f8adb078d8ad549
    ffa720d90a79c1f33cf4c5a33403d09a67b42a66

More information

For further information and in case of questions, please contact the 
phpMyAdmin team. Our website is phpmyadmin.net.


PMASA-2013-3

Announcement-ID: PMASA-2013-3

Date: 2013-04-24
Summary

Locally Saved SQL Dump File Multiple File Extension Remote Code Execution.
Description

phpMyAdmin can be configured to save an export file on the web server, via its 
SaveDir directive. With this in place, it's possible, either via a crafted 
filename template or a crafted table name, to save a double extension file 
like foobar.php.sql. In turn, an Apache webserver on which there is no 
definition for the MIME type "sql" (the default) will treat this saved file as 
a ".php" script, leading to remote code execution.
Severity

We consider this vulnerability to be serious.
Mitigation factor

This vulnerability can be triggered only by someone who logged in to 
phpMyAdmin, as the usual token protection prevents non-logged-in users to 
access the required form. Moreover, the SaveDir directive is empty by default, 
so a default configuration is not vulnerable. The $cfg['SaveDir'] directive 
must be configured, and the server must be running Apache with mod_mime to be 
exploitable.
Affected Versions

Versions 3.5.x and 4.0.0 (before -rc3) are affected.
Solution

For 3.5.x, upgrade to phpMyAdmin 3.5.8 or newer; for 4.0.x, upgrade to 
4.0.0-rc3 or newer. You can also apply the patches listed below.
References

Thanks to Janek Vind for reporting this issue.

Assigned CVE ids: CVE-2013-3239

CWE ids: CWE-661 CWE-94
Patches

The following commits have been made on the 3.5 branch to fix this issue:

    d3fafdfba0807068196655e9b6d16c5d1d3ccf8a
    1f6bc0b707002e26cab216b9e57b4d5de764de48

More information

For further information and in case of questions, please contact the 
phpMyAdmin team. Our website is phpmyadmin.net.


PMASA-2013-4

Announcement-ID: PMASA-2013-4

Date: 2013-04-24
Summary

Local file inclusion vulnerability.
Description

In the Export feature, a parameter specifying the export type was not 
correctly validated, opening the door to a local file inclusion attack.
Severity

We consider this vulnerability to be serious.
Mitigation factor

This vulnerability can be triggered only by someone who logged in to 
phpMyAdmin, as the usual token protection prevents non-logged-in users to 
access the required form.
Affected Versions

phpMyAdmin versions 4.x (prior to 4.0.0-rc3).
Solution

Upgrade to phpMyAdmin 4.0.0-rc3 or newer.
References

Thanks to Janek Vind for reporting this issue.

Assigned CVE ids: CVE-2013-3240

CWE ids: CWE-661 CWE-98
More information

For further information and in case of questions, please contact the 
phpMyAdmin team. Our website is phpmyadmin.net.


PMASA-2013-5

Announcement-ID: PMASA-2013-5

Date: 2013-04-24
Summary

Global variables overwrite in "export.php".
Description

The export script generates global variables from those present in the $_POST 
superglobal. This may lead to other exploits in the export script.
Severity

We consider this vulnerability to be serious.
Mitigation factor

This vulnerability can be triggered only by someone who logged in to 
phpMyAdmin, as the usual token protection prevents non-logged-in users to 
access the required form.
Affected Versions

phpMyAdmin versions 4.x (prior to 4.0.0-rc3).
Solution

Upgrade to phpMyAdmin 4.0.0-rc3 or newer.
References

Thanks to Janek Vind for reporting this issue.

Assigned CVE ids: CVE-2013-3241

CWE ids: CWE-661
More information

For further information and in case of questions, please contact the 
phpMyAdmin team. Our website is phpmyadmin.net.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUXoGYO4yVqjM2NGpAQIJeQ//QswtYJ2EXx6S+Bd8mHn2/gj8y0J5ppcd
lWbrvjlQuHRbCKLjSph8cJ4D221sp6LjP80YZUCubI+mS93fliC6kTH2p3lWSSzo
sbbKnSD/+Cyk7ASj5r/Dx99jpI6RVKZ0KL7aoK+p4RPbxSKXkszT2Ckxg4UQNc6y
E3Fxh7o6UExuHK50SkdNHK7240mxfWAsVYgQM70lwQ8a2krqK6QV51KYGy/JyHJc
kLRxZp11bJnzfEGmFryBcf5Vp4vLSqEz8AXwAd7jCq/cCUAZNVTKuLoRYEG//V03
fQPXdQvw40XUOB0rMppgwoxNbFYILloS4R67Crrr6M5Ac6MnvbZK7/GR5zzITyTd
zVGl/F58D9p0XkgmpodmtsGehOtNPU6LS9qDrFgZFfJbde2PF3ZM8wMtNBx5jtLC
j50Nbn7fNQyL/ULyzykKsWH1M+jbHjD3b69xBFYfPM3itB7LftFZo29OPvnxhbf5
nXnIB6UgDOsHW7BMZp3w3DP8B4ba/kLgqp2i30eWprkYAAS/TJ1deRagnXsG8d+l
iV4PQ8PbLaoHf1XZ53/cCQ4ERvqKLm4wHQgNQKI/pd5IwjfD8UZz5ot0TPMGI47s
yUOG2Ssp709qV6eI42PVEV7RLEedLzrGih4Z0ptW9FqsP0FyPUIq7hmVmAuBKcDr
vmRNpJQ0eqQ=
=vHf/
-----END PGP SIGNATURE-----