Directory traversal vulnerability in libraries/display_tbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a certain MIME transformation feature is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in a GLOBALS[mime_map][$meta->name][transformation] parameter.

The remote host is affected by the vulnerability described in GLSA-201201-01 (phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in phpMyAdmin. Please       review the CVE identifiers and phpMyAdmin Security Advisories referenced       below for details.
  Impact :

    Remote attackers might be able to insert and execute PHP code, include       and execute local PHP files, or perform Cross-Site Scripting (XSS)       attacks via various vectors.
  Workaround :

    There is no known workaround at this time.

The remote host contains a version of phpMyAdmin - 3.3.x less than 3.3.10.2 or 3.4.x less than 3.4.3.1 - that is affected by multiple vulnerabilities :

  - An error in the file     'libraries/auth/swekey/swekey.auth.lib.php' allows an     attacker to modify the 'SESSION' superglobal array.
    (CVE-2011-2505)

  - An error in the file     'setup/lib/ConfigGenerator.class.php' does not properly     handle PHP comment-closing delimiters. This can allow     an attacker inject static code via a modified 'SESSION'     superglobal array. (CVE-2011-2506)

  - An error in the file     'libraries/server_synchronize.lib.php' does not properly     call the 'preg_replace' function. This can allow an     attacker to execute arbitrary code via a modified     'SESSION' superglobal array. (CVE-2011-2507)

  - An local file inclusion error exists in the     'PMA_displayTableBody' function in the file     'libraries/display_tbl.lib.php' that can allow an     attacker to obtain sensitive information or execute     code in file already present on the host.
    (CVE-2011-2508)

Several vulnerabilities were discovered in phpMyAdmin, a tool to administrate MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2011-2505     Possible session manipulation in Swekey authentication.

  - CVE-2011-2506     Possible code injection in setup script, in case session     variables are compromised.

  - CVE-2011-2507     Regular expression quoting issue in Synchronize code.

  - CVE-2011-2508     Possible directory traversal in MIME-type     transformation.

  - CVE-2011-2642     Cross site scripting in table Print view when the     attacker can create crafted table names.

  - No CVE name yet

    Possible superglobal and local variables manipulation in     Swekey authentication. (PMASA-2011-12)

The oldstable distribution (lenny) is only affected by CVE-2011-2642, which has been fixed in version 2.11.8.1-5+lenny9.

Changes for 3.4.3.1 (2011-06-07)

  - [PMASA-2011-5] Possible session manipulation in Swekey     authentication     (http://www.phpmyadmin.net/home_page/security/PMASA-2011
    -5.php)

    - [PMASA-2011-6] Possible code injection in setup script       in case session variables are compromised       (http://www.phpmyadmin.net/home_page/security/PMASA-20       11-6.php)

    - [PMASA-2011-7] Regular expression quoting issue in       Synchronize code       (http://www.phpmyadmin.net/home_page/security/PMASA-20       11-7.php)

    - [PMASA-2011-8] Possible directory traversal       (http://www.phpmyadmin.net/home_page/security/PMASA-20       11-8.php)

Changes for 3.4.3.0 (2011-06-27)

  - [sync] Missing helper icons in Synchronize

    - [setup] Redefine a lable that was wrong

    - [parser] master is not a reserved word

    - [edit] Inline edit updates multiple duplicate rows

    - [edit] Inline edit does not escape backslashes

    - [interface] Columns class sometimes changed for       nothing

    - [interface] Some tooltips do not disappear

    - [search] Fix search in non unicode tables

    - [display] Inline query edit broken

    - [privileges] Generate password option missing on new       accounts

    - [edit] Inline edit places HTML line breaks in edit       area

    - [interface] Inline query edit does not escape special       characters

    - [security] minor XSS (require a valid token)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of phpMyAdmin 3.3.x earlier than 3.3.10.2 and 3.4.x earlier than 3.4.3.1 are potentially affected by multiple vulnerabilities : 

  - It is possible to manipulate the PHP session superglobal usig some of the Swekey authentication code. (PMASA-2011-5)

  - An unsanitized key from the Servers array is written in a comment of the generated config, which could allow an attacker to close the comment and inject code. (PMASA-2011-6)

  - It is possible to use a null byte to truncate the pattern string which would allow an attacker to inject the /e modifier causing the pre_replace function to execute its second argument as PHP code. (PMASA-2011-7)

  - An issue exists in the MIME-type transformation code, which allows for directory traversal. (PMASA-2011-8)

The phpMyAdmin development team reports :

It was possible to manipulate the PHP session superglobal using some of the Swekey authentication code. This could open a path for other attacks.

An unsanitized key from the Servers array is written in a comment of the generated config. An attacker can modify this key by modifying the SESSION superglobal array. This allows the attacker to close the comment and inject code.

Through a possible bug in PHP running on Windows systems a NULL byte can truncate the pattern string allowing an attacker to inject the /e modifier causing the preg_replace function to execute its second argument as PHP code.

Fixed filtering of a file path in the MIME-type transformation code, which allowed for directory traversal.

ID	Name	Product	Family	Severity
57433	GLSA-201201-01 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
57346	phpMyAdmin 3.3.x / 3.4.x < 3.3.10.2 / 3.4.3.1 Multiple Vulnerabilities (PMASA-2011-5 - PMASA-2011-8)	Nessus	CGI abuses	high
55708	Debian DSA-2286-1 : phpmyadmin - several vulnerabilities	Nessus	Debian Local Security Checks	high
55604	Fedora 14 : phpMyAdmin-3.4.3.1-1.fc14 (2011-9144)	Nessus	Fedora Local Security Checks	high
5985	phpMyAdmin 3.3.x < 3.3.10.2 / 3.4.x < 3.4.3.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
55502	FreeBSD : phpmyadmin -- multiple vulnerabilities (7e4e5c53-a56c-11e0-b180-00216aa06fc2)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2011-2508

high

Tenable Plugins

critical

high

high

high

medium

high