-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                    ESB-2005.0973 -- [Win][UNIX/Linux]
                phpMyAdmin Variable Overwrite Vulnerability
                              9 December 2005

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           phpMyAdmin 2.7.0
Publisher:         Hardened-PHP Project
Operating System:  Windows
                   UNIX variants (UNIX, Linux, OSX)
Impact:            Execute Arbitrary Code/Commands
                   Inappropriate Access
Access:            Remote/Unauthenticated

Original Bulletin: http://www.hardened-php.net/advisory_252005.110.html

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


                        Hardened-PHP Project
                        www.hardened-php.net

                      -= Security  Advisory =-



     Advisory: phpMyAdmin Variable Overwrite Vulnerability
 Release Date: 2005/12/07
Last Modified: 2005/12/07
       Author: Stefan Esser [sesser@hardened-php.net]

  Application: phpMyAdmin 2.7.0(-rc1)
     Severity: A flaw in the variable overwrite protection may lead
               to several XSS and local and remote file inclusion 
               vulnerabilities
         Risk: Critical
Vendor Status: Vendor has released an updated version
   References: http://www.hardened-php.net/advisory_252005.110.html


Overview:

   Quote from www.phpmyadmin.net:
   "phpMyAdmin is a tool written in PHP intended to handle the 
   administration of MySQL over the Web. Currently it can create 
   and drop databases, create/drop/alter tables, delete/edit/add 
   fields, execute any SQL statement, manage keys on fields, manage 
   privileges,export data into various formats and is available 
   in 50 languages."
   
   A quick audit of the variable overwrite protection that was
   redesigned for phpMyAdmin 2.7.0 revealed an easy to exploit flaw,
   that leads to total failure of the protection and therefore 
   opens phpMyAdmin to a number of XSS, local and remote file
   inclusion vulnerabilities.


Details:

   phpMyAdmin comes with a register_globals emulation layer within
   grab_globals.php, to ensure compatibility with hosts where this 
   feature is turned off. This layer was heavily modified for the
   release of phpMyAdmin 2.7.0. One of the major changes is, that
   the blacklist of variables that may not be overwritten by the
   emulation layer is now stored in a global variable.
   
   Unfortunately the variablename $import_blacklist is not covered
   by the protection and therefore it was possible for an attacker
   to overwrite the blacklist. After the blacklist is overwritten
   an attacker can f.e. overwrite the $GLOBALS array with arbitrary
   content and therefore exploit several places where the $GLOBALS 
   array is used. 
   
   During normal execution this $GLOBALS array is just another way
   to access global variables, but when a script overwrites it,
   it becomes a normal variable, with a few exceptions in PHP4.
   For more information about what unexpected things can happen 
   when $GLOBALS is overwritten please have a look at
      
      http://www.hardened-php.net/globals-problem
   
   In phpMyAdmin $GLOBALS is used f.e. in the CSS generator to
   access the global variable that stores the configuration. Due
   to the fact, that the content of this variable is under total
   control of the attacker the path to an included file can be
   injected. This leads to an remote URL include vulnerability
   in PHP5 and a local file include vulnerability in PHP4.
   
   The difference is caused by the fact, that the PHP function 
   file_exists() does not work on URL wrappers within PHP4, but
   works on ftp:// URLs in PHP5. (When the host is running our
   Hardening-Patch for PHP such a remote URL inclusion is of 
   course not allowed and logged).
   
   Please also note that there are multiple (easy) ways to
   get PHP code into files on the server, so that local file
   inclusion vulnerabilities are more dangerous than they seem.
   Additionally it is possible to directly include PEAR.php
   from the installed PHP distribution. If it is one that
   was shipped with PHP <= 4.3.10 this can be used to directly
   execute code on the server by manipulating the destructor
   list.
   
   There are other places in phpMyAdmin, where this vulnerability
   can lead to XSS and other local file inclusion vulnerabilities.
   Those will not be listed separately, because the problem
   mentioned above is already serious enough to demonstrate the 
   impact of the failing overwrite protection.
	 

Proof of Concept:

   The Hardened-PHP project is not going to release exploits for 
   this vulnerability to the public.


Disclosure Timeline:

   6. December 2005 - Disclosed vulnerability to vendor
   7. December 2005 - Release of new phpMyAdmin version
   7. December 2005 - Public Disclosure


Recommendation:

   It is strongly recommended to upgrade to the new version of
   phpMyAdmin which you can download at:

      http://www.phpmyadmin.net/home_page/downloads.php


GPG-Key:

   http://www.hardened-php.net/hardened-php-signature-key.asc

   pub  1024D/0A864AA1 2004-04-17 Hardened-PHP Signature Key
   Key fingerprint = 066F A6D0 E57E 9936 9082  7E52 4439 14CC 0A86 4AA1


Copyright 2005 Stefan Esser. All rights reserved.

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQFDlrwQRDkUzAqGSqERAmRXAJ91rK7yBmaD11xKZYT/3AQssLcx1ACdEmxV
ikwFLy/0HqQmcWp98DVzCVk=
=BCKL
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBQ5kZKSh9+71yA2DNAQLWlAP9GjjV/mcEvcak6dh4d0BVjT6mP5DpcIcJ
HKKDB4ffHEn4gnvzgSOIwLzz3GYenDYrbRocuAt0tHlhhn/E9WOibIwXvzy+CwVc
+7FZ3zWDBtmv6i3te20evftwqrSRQ6/vW/kBWDG+z3qP5uz2BjVWW3e5YE/Im0E1
J1iDSbqOUfQ=
=Wm2n
-----END PGP SIGNATURE-----