full-disclosure - Vulnerabilities in phpMyAdmin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 28 Feb 2011 21:09:49 +0200
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>
Subject: Vulnerabilities in phpMyAdmin

Hello list!

I want to warn you about Brute Force and Full path disclosure
vulnerabilities in phpMyAdmin.

CVE id: CVE-2011-0986.

WASC ids: WASC-11, WASC-13.

CWE ids: CWE-661, CWE-200.

-------------------------
Affected products:
-------------------------

Vulnerable are phpMyAdmin 3.3.9 and previous versions and phpMyAdmin
2.11.11.1 and previous versions. All applications (such as XAMPP), which are
using phpMyAdmin, are also vulnerable.

Full path disclosure vulnerabilities were fixed by developers in versions
3.3.9.1 and 2.11.11.2.

----------
Details:
----------

Brute Force (WASC-11):

http://site/phpmyadmin/

In login form there is no protection from Brute Force attacks.

Full path disclosure (WASC-13):

http://site/phpmyadmin/readme.php (if there is no README file in folder 
phpmyadmin)

http://site/phpmyadmin/changelog.php (if there is no ChangeLog file in 
folder phpmyadmin)

http://site/phpmyadmin/license.php (if there is no LICENSE file in folder 
phpmyadmin)

------------
Timeline:
------------

2011.01.25 - announced at my site.
2011.01.26 - informed developers.
2011.01.31 - received answer from developers.
2011-02-01 - I gave developers additional argumentations and recommendations
about fixing Brute Force and Full path disclosure holes and privately
informed about all those Fingerprinting (WASC-45) holes in phpMyAdmin.
2011-02-08 - developers fixed FPD holes
(http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php).
2011.02.28 - disclosed at my site.

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/4872/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/