Vulnerabilities > CVE-2016-6618 - Denial of Service vulnerability in phpMyAdmin

047910
CVSS 4.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
SINGLE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
phpmyadmin
nessus

Summary

An issue was discovered in phpMyAdmin. The transformation feature allows a user to trigger a denial-of-service (DoS) attack against the server. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

Vulnerable Configurations

Part Description Count
Application
Phpmyadmin
60

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1415.NASL
    descriptionSeveral vulnerabilities were found in phpMyAdmin, the web-based MySQL administration interface, including SQL injection attacks, denial of service, arbitrary code execution, cross-site scripting, server-side request forgery, authentication bypass, and file system traversal. For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id110945
    published2018-07-09
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110945
    titleDebian DLA-1415-1 : phpmyadmin security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Debian Security Advisory DLA-1415-1. The text
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(110945);
      script_version("1.3");
      script_cvs_date("Date: 2018/08/08 12:52:14");
    
      script_cve_id("CVE-2016-6609", "CVE-2016-6614", "CVE-2016-6615", "CVE-2016-6616", "CVE-2016-6618", "CVE-2016-6619", "CVE-2016-6620", "CVE-2016-6621", "CVE-2016-6622", "CVE-2016-9865", "CVE-2017-18264");
    
      script_name(english:"Debian DLA-1415-1 : phpmyadmin security update");
      script_summary(english:"Checks dpkg output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several vulnerabilities were found in phpMyAdmin, the web-based MySQL
    administration interface, including SQL injection attacks, denial of
    service, arbitrary code execution, cross-site scripting, server-side
    request forgery, authentication bypass, and file system traversal.
    
    For Debian 8 'Jessie', these problems have been fixed in version
    4:4.2.12-2+deb8u3.
    
    We recommend that you upgrade your phpmyadmin packages.
    
    NOTE: Tenable Network Security has extracted the preceding description
    block directly from the DLA security advisory. Tenable has attempted
    to automatically clean and format it as much as possible without
    introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/phpmyadmin"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Upgrade the affected phpmyadmin package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:phpmyadmin");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2018/07/06");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/07/09");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"8.0", prefix:"phpmyadmin", reference:"4:4.2.12-2+deb8u3")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyCGI abuses
    NASL idPHPMYADMIN_PMASA_2016_29.NASL
    descriptionAccording to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.17, 4.4.x prior to 4.4.15.8, or 4.6.x prior to 4.6.4. It is, therefore, affected by the following vulnerabilities : - An information disclosure vulnerability exists due to the use of an algorithm that is vulnerable to padding oracle attacks. An unauthenticated, remote attacker can exploit this to decrypt information without the key, resulting in the disclosure of usernames and passwords. (CVE-2016-6606) - A cross-site scripting (XSS) vulnerability exists in the replication_gui.lib.php script due to improper validation of user-supplied input to the
    last seen2020-06-01
    modified2020-06-02
    plugin id95027
    published2016-11-21
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95027
    titlephpMyAdmin 4.0.x < 4.0.10.17 / 4.4.x < 4.4.15.8 / 4.6.x < 4.6.4 Multiple Vulnerabilities (PMASA-2016-29 - PMASA-2016-56)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-1021.NASL
    descriptionphpMyAdmin was updated to version 4.4.15.8 (2016-08-16) to fix the following issues : - Upstream changelog for 4.4.15.8 : - Improve session cookie code for openid.php and signon.php example files - Full path disclosure in openid.php and signon.php example files - Unsafe generation of BlowfishSecret (when not supplied by the user) - Referrer leak when phpinfo is enabled - Use HTTPS for wiki links - Improve SSL certificate handling - Fix full path disclosure in debugging code - Administrators could trigger SQL injection attack against users - other fixes - Remove Swekey support - Security fixes: https://www.phpmyadmin.net/security/ - Weaknesses with cookie encryption see PMASA-2016-29 (CVE-2016-6606, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-30 (CVE-2016-6607, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-31 (CVE-2016-6608, CWE-661) - PHP code injection see PMASA-2016-32 (CVE-2016-6609, CWE-661) - Full path disclosure see PMASA-2016-33 (CVE-2016-6610, CWE-661) - SQL injection attack see PMASA-2016-34 (CVE-2016-6611, CWE-661) - Local file exposure through LOAD DATA LOCAL INFILE see PMASA-2016-35 (CVE-2016-6612, CWE-661) - Local file exposure through symlinks with UploadDir see PMASA-2016-36 (CVE-2016-6613, CWE-661) - Path traversal with SaveDir and UploadDir see PMASA-2016-37 (CVE-2016-6614, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-38 (CVE-2016-6615, CWE-661) - SQL injection vulnerability as control user see PMASA-2016-39 (CVE-2016-6616, CWE-661) - SQL injection vulnerability see PMASA-2016-40 (CVE-2016-6617, CWE-661) - Denial-of-service attack through transformation feature see PMASA-2016-41 (CVE-2016-6618, CWE-661) - SQL injection vulnerability as control user see PMASA-2016-42 (CVE-2016-6619, CWE-661) - Verify data before unserializing see PMASA-2016-43 (CVE-2016-6620, CWE-661) - SSRF in setup script see PMASA-2016-44 (CVE-2016-6621, CWE-661) - Denial-of-service attack with $cfg[
    last seen2020-06-05
    modified2016-08-30
    plugin id93212
    published2016-08-30
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/93212
    titleopenSUSE Security Update : phpMyAdmin (openSUSE-2016-1021)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_EF70B201645D11E69CDC6805CA0B3D42.NASL
    descriptionThe phpmyadmin development team reports : Weakness with cookie encryption Multiple XSS vulnerabilities Multiple XSS vulnerabilities PHP code injection Full path disclosure SQL injection attack Local file exposure Local file exposure through symlinks with UploadDir Path traversal with SaveDir and UploadDir Multiple XSS vulnerabilities SQL injection attack SQL injection attack Denial of service (DOS) attack in transformation feature SQL injection attack as control user Unvalidated data passed to unserialize() DOS attack with forced persistent connections Denial of service (DOS) attack by for loops IPv6 and proxy server IP-based authentication rule circumvention Detect if user is logged in Bypass URL redirect protection Referrer leak in url.php Reflected File Download attack ArbitraryServerRegexp bypass Denial of service (DOS) attack by changing password to a very long string Remote code execution vulnerability when run as CGI Summary Denial of service (DOS) attack with dbase extension Remote code execution vulnerability when PHP is running with dbase extension
    last seen2020-06-01
    modified2020-06-02
    plugin id93024
    published2016-08-18
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93024
    titleFreeBSD : phpmyadmin -- multiple vulnerabilities (ef70b201-645d-11e6-9cdc-6805ca0b3d42)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201701-32.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201701-32 (phpMyAdmin: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in phpMyAdmin. Please review the CVE identifiers referenced below for details. Impact : A authenticated remote attacker could exploit these vulnerabilities to execute arbitrary PHP Code, inject SQL code, or to conduct Cross-Site Scripting attacks. In certain configurations, an unauthenticated remote attacker could cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id96426
    published2017-01-12
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96426
    titleGLSA-201701-32 : phpMyAdmin: Multiple vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-1027.NASL
    descriptionThis phpMyAdmin update to version 4.4.15.8 fixes the following issues : Security issues fixed : - Improve session cookie code for openid.php and signon.php example files - Full path disclosure in openid.php and signon.php example files - Unsafe generation of BlowfishSecret (when not supplied by the user) - Referrer leak when phpinfo is enabled - Use HTTPS for wiki links - Improve SSL certificate handling - Fix full path disclosure in debugging code - Administrators could trigger SQL injection attack against users - Weaknesses with cookie encryption see PMASA-2016-29 (CVE-2016-6606, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-30 (CVE-2016-6607, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-31 (CVE-2016-6608, CWE-661) - PHP code injection see PMASA-2016-32 (CVE-2016-6609, CWE-661) - Full path disclosure see PMASA-2016-33 (CVE-2016-6610, CWE-661) - SQL injection attack see PMASA-2016-34 (CVE-2016-6611, CWE-661) - Local file exposure through LOAD DATA LOCAL INFILE see PMASA-2016-35 (CVE-2016-6612, CWE-661) - Local file exposure through symlinks with UploadDir see PMASA-2016-36 (CVE-2016-6613, CWE-661) - Path traversal with SaveDir and UploadDir see PMASA-2016-37 (CVE-2016-6614, CWE-661) - Multiple XSS vulnerabilities see PMASA-2016-38 (CVE-2016-6615, CWE-661) - SQL injection vulnerability as control user see PMASA-2016-39 (CVE-2016-6616, CWE-661) - SQL injection vulnerability see PMASA-2016-40 (CVE-2016-6617, CWE-661) - Denial-of-service attack through transformation feature see PMASA-2016-41 (CVE-2016-6618, CWE-661) - SQL injection vulnerability as control user see PMASA-2016-42 (CVE-2016-6619, CWE-661) - Verify data before unserializing see PMASA-2016-43 (CVE-2016-6620, CWE-661) - SSRF in setup script see PMASA-2016-44 (CVE-2016-6621, CWE-661) - Denial-of-service attack with $cfg[
    last seen2020-06-05
    modified2016-08-30
    plugin id93214
    published2016-08-30
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/93214
    titleopenSUSE Security Update : phpMyAdmin (openSUSE-2016-1027)