The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-4779-1 advisory.

    Danilo Segan discovered that Gettext mishandled certain input. An attacker could use this vulnerability to     execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.19, 4.4.x prior to 4.4.15.10, or 4.6.x prior to 4.6.6. It is, therefore, affected by the following vulnerabilities :

  - An open redirect vulnerability exists due to a failure     to validate request paths before returning them to     users. An unauthenticated, remote attacker can exploit     this, by convincing a user to follow a specially crafted     link, to redirect the user from the intended legitimate     website to an arbitrary website of the attacker's     choosing. (PMASA-2017-1)

  - An arbitrary code execution vulnerability exists in the     php-gettext component in the select_string() function     due to improper sanitization of user-supplied input. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (PMASA-2017-2, CVE-2015-8980)

  - A denial of service vulnerability exists in the goto()     function due to improper handling of table data. An     unauthenticated, remote attacker can exploit this to     launch a recursive include operation, resulting in a     denial of service condition. (PMASA-2017-3)

  - A flaw exists due to a failure to sanitize input passed     via cookie parameters. An unauthenticated, remote     attacker can exploit this to inject arbitrary CSS in     themes. (PMASA-2017-4)

  - An unspecified flaw exists that allows an     unauthenticated, remote attacker to inject arbitrary     values into browser cookies. (PMASA-2017-5,     CVE-2016-5702)

  - A server-side request forgery vulnerability exists that     allows an authenticated, remote attacker to bypass     access restrictions (e.g. host or network ACLs) and     connect to hosts without the appropriate authorization.
    Note that this vulnerability only affects the 4.6.x     version branch. (PMASA-2017-6)

  - A denial of service vulnerability exists in the     replication status functionality due to improper     handling of specially crafted table names. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (PMASA-2017-7)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

This update to phpMyAdmin 4.4.15.10 fixes the following security issues :

  - CVE-2016-6621: Multiple vulnerabilities in setup script     (PMASA-2016-44)

  - Open redirect (PMASA-2017-1)

  - CVE-2015-8980: php-gettext code execution (PMASA-2017-2)

  - DOS vulnerability in table editing (PMASA-2017-3)

  - CSS injection in themes (PMASA-2017-4)

  - SSRF in replication (PMASA-2017-6)

  - DOS in replication status (PMASA-2017-7)

The phpMyAdmin development team reports :

Open redirect

php-gettext code execution

DOS vulnerability in table editing

CSS injection in themes

Cookie attribute injection attack

SSRF in replication

DOS in replication status

ID	Name	Product	Family	Severity
183530	Ubuntu 16.04 ESM : Gettext vulnerability (USN-4779-1)	Nessus	Ubuntu Local Security Checks	critical
99280	phpMyAdmin 4.0.x < 4.0.10.19 / 4.4.x < 4.4.15.10 / 4.6.x < 4.6.6 Multiple Vulnerabilities (PMASA-2017-1 - PMASA-2017-7)	Nessus	CGI abuses	critical
97001	openSUSE Security Update : phpMyAdmin (openSUSE-2017-198)	Nessus	SuSE Local Security Checks	critical
96742	FreeBSD : phpMyAdmin -- Multiple vulnerabilities (7721562b-e20a-11e6-b2e2-6805ca0b3d42)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2015-8980

critical

Tenable Plugins

critical

critical

critical

critical