libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value.

Several vulnerabilities have been fixed in phpMyAdmin, the web-based MySQL administration interface.

  - CVE-2016-1927     The suggestPassword function relied on a non-secure     random number generator which makes it easier for remote     attackers to guess generated passwords via a brute-force     approach.

  - CVE-2016-2039     CSRF token values were generated by a non-secure random     number generator, which allows remote attackers to     bypass intended access restrictions by predicting a     value.

  - CVE-2016-2040     Multiple cross-site scripting (XSS) vulnerabilities     allow remote authenticated users to inject arbitrary web     script or HTML.

  - CVE-2016-2041     phpMyAdmin does not use a constant-time algorithm for     comparing CSRF tokens, which makes it easier for remote     attackers to bypass intended access restrictions by     measuring time differences.

  - CVE-2016-2560     Multiple cross-site scripting (XSS) vulnerabilities     allow remote attackers to inject arbitrary web script or     HTML.

  - CVE-2016-2561     Multiple cross-site scripting (XSS) vulnerabilities     allow remote attackers to inject arbitrary web script or     HTML.

  - CVE-2016-5099     Multiple cross-site scripting (XSS) vulnerabilities     allow remote attackers to inject arbitrary web script or     HTML.

  - CVE-2016-5701     For installations running on plain HTTP, phpMyAdmin     allows remote attackers to conduct BBCode injection     attacks against HTTP sessions via a crafted URI.

  - CVE-2016-5705     Multiple cross-site scripting (XSS) vulnerabilities     allow remote attackers to inject arbitrary web script or     HTML.

  - CVE-2016-5706     phpMyAdmin allows remote attackers to cause a denial of     service (resource consumption) via a large array in the     scripts parameter.

  - CVE-2016-5731     A cross-site scripting (XSS) vulnerability allows remote     attackers to inject arbitrary web script or HTML.

  - CVE-2016-5733     Multiple cross-site scripting (XSS) vulnerabilities     allow remote attackers to inject arbitrary web script or     HTML.

  - CVE-2016-5739     A specially crafted Transformation could leak     information which a remote attacker could use to perform     cross site request forgeries.

The previous security upload broke the search pages in phpMyAdmin.
This was caused by a broken patch applied to fix CVE-2016-2040.

For Debian 7 'Wheezy', these problems have been fixed in version 4:3.4.11.1-2+deb7u4.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

phpMyAdmin 4.5.4.1 (2016-01-28) =============================== - Error with PMA 4.4.15.3 - Remove hard dependency on phpseclib phpMyAdmin 4.5.4 (2016-01-28) ============================= - live data edit of big sets is not working - Table list not saved in db QBE bookmarked search - While 'changing a column', query fails with a syntax error after the 'CHARSET=' keyword - Avoid syntax error in JavaScript messages on invalid PHP setting for max_input_vars - Properly handle errors in upacking zip archive - Set PHP's internal encoding to UTF-8 - Fixed Kanji encoding in some specific cases - Check whether iconv works before using it - Avoid conversion of MySQL error messages - Undefined index: parameters - Undefined index:
field_name_orig - Undefined index: host - 'Add to central columns' (per column button) does nothing - SQL duplicate entry error trying to INSERT in designer_settings table - Fix handling of databases with dot in a name - Fix hiding of page content behind menu - FROM clause not generated after loading search bookmark - Fix creating/editing VIEW with DEFINER containing special chars - Do not invoke FLUSH PRIVILEGES when server in --skip- grant-tables - Misleading message for configuration storage - Table pagination does nothing when session expired - Index comments not working properly - Better handle local storage errors - Improve detection of privileges for privilege adjusting - Undefined property: stdClass::$releases at version check when disabled in config - SQL comment and variable stripped from bookmark on save - Gracefully handle errors in regex based JavaScript search - [Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-1 - [Security] Unsafe generation of CSRF token, see PMASA-2016-2 - [Security] Multiple XSS vulnerabilities, see PMASA-2016-3 - [Security] Insecure password generation in JavaScript, see PMASA-2016-4 - [Security] Unsafe comparison of CSRF token, see PMASA-2016-5 - [Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-6 - [Security] XSS vulnerability in normalization page, see PMASA-2016-7 - [Security] Full path disclosure vulnerability in SQL parser, see PMASA-2016-8 - [Security] XSS vulnerability in SQL editor, see PMASA-2016-9

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

phpMyAdmin 4.5.4 (2016-01-28) ============================= - live data edit of big sets is not working - Table list not saved in db QBE bookmarked search - While 'changing a column', query fails with a syntax error after the 'CHARSET=' keyword - Avoid syntax error in JavaScript messages on invalid PHP setting for max_input_vars - Properly handle errors in upacking zip archive - Set PHP's internal encoding to UTF-8 - Fixed Kanji encoding in some specific cases - Check whether iconv works before using it - Avoid conversion of MySQL error messages - Undefined index: parameters - Undefined index:
field_name_orig - Undefined index: host - 'Add to central columns' (per column button) does nothing - SQL duplicate entry error trying to INSERT in designer_settings table - Fix handling of databases with dot in a name - Fix hiding of page content behind menu - FROM clause not generated after loading search bookmark - Fix creating/editing VIEW with DEFINER containing special chars - Do not invoke FLUSH PRIVILEGES when server in --skip-grant-tables - Misleading message for configuration storage - Table pagination does nothing when session expired - Index comments not working properly - Better handle local storage errors - Improve detection of privileges for privilege adjusting - Undefined property: stdClass::$releases at version check when disabled in config - SQL comment and variable stripped from bookmark on save - Gracefully handle errors in regex based JavaScript search - [Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-1 - [Security] Unsafe generation of CSRF token, see PMASA-2016-2 - [Security] Multiple XSS vulnerabilities, see PMASA-2016-3 - [Security] Insecure password generation in JavaScript, see PMASA-2016-4 - [Security] Unsafe comparison of CSRF token, see PMASA-2016-5 - [Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-6 - [Security] XSS vulnerability in normalization page, see PMASA-2016-7 - [Security] Full path disclosure vulnerability in SQL parser, see PMASA-2016-8 - [Security] XSS vulnerability in SQL editor, see PMASA-2016-9

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of phpMyAdmin 4.0.x prior to 4.0.10.13, 4.4.x prior to 4.4.15.3, and 4.5.x prior to 4.5.4 are unpatched for the following vulnerabilities : 

 - A security bypass vulnerability exists due to the use of the 'Math.random()' JavaScript function which does not provide cryptographically secure random numbers. A remote attacker can exploit this to guess passwords via a brute-force attack. (CVE-2016-1927)
 - An information disclosure vulnerability exists in multiple scripts that allows a remote attacker, via a specially crafted request, to disclose the software's installation path. (CVE-2016-2038)
 - A security bypass vulnerability exists due to generating XSRF tokens with cryptographically insecure values. A remote attacker can exploit this to bypass intended access restrictions by predicting a value. (CVE-2016-2039)
 - Multiple cross-site scripting vulnerabilities exist due to improper validation of user-supplied input to the home, database search, and zoom search pages. An authenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2016-2040)
 - A security bypass vulnerability exists due to a failure to use a constant-time algorithm for comparing XSRF tokens. A remote attacker can exploit this, via a timing attack, to bypass intended access restrictions. (CVE-2016-2041)

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.13, 4.4.x prior to 4.4.15.3, or 4.5.x prior to 4.5.4. It is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists due to the use of     the Math.random() JavaScript function which does not     provide cryptographically secure random numbers. A     remote attacker can exploit this to guess passwords via     a brute-force attack. (CVE-2016-1927)

  - An information disclosure vulnerability exists in     multiple scripts that allows a remote attacker, via a     specially crafted request, to disclose the software's     installation path. (CVE-2016-2038)

  - A security bypass vulnerability exists due to generating     XSRF tokens with cryptographically insecure values. A     remote attacker can exploit this to bypass intended     access restrictions by predicting a value.
    (CVE-2016-2039)

  - Multiple cross-site scripting vulnerabilities exist due     to improper validation of user-supplied input to the     home, database search, and zoom search pages. An     authenticated, remote attacker can exploit this, via a     specially crafted request, to execute arbitrary script     code in a user's browser session. (CVE-2016-2040)

  - A security bypass vulnerability exists due to a failure     to use a constant-time algorithm for comparing XSRF     tokens. A remote attacker can exploit this, via a timing     attack, to bypass intended access restrictions.
    (CVE-2016-2041)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

Security update to phpMyAdmin 4.4.15.4

The followinng vulnerabilities were fixed: (boo#964024)

  - CVE-2016-2038: Multiple full path disclosure     vulnerabilities

  - CVE-2016-2039: Unsafe generation of XSRF/CSRF token

  - CVE-2016-2040: Multiple XSS vulnerabilities

  - CVE-2016-1927: Insecure password generation in     JavaScript

  - CVE-2016-2041: Unsafe comparison of XSRF/CSRF token

  - CVE-2016-2042: Multiple full path disclosure     vulnerabilities

  - CVE-2016-2043: XSS vulnerability in normalization page

This update to phpMyAdmin 4.4.15.4 fixes the following issues (boo#964024)

  - CVE-2016-2038: Multiple full path disclosure     vulnerabilities

  - CVE-2016-2039: Unsafe generation of XSRF/CSRF token

  - CVE-2016-2040: Multiple XSS vulnerabilities

  - CVE-2016-1927: Insecure password generation in     JavaScript

  - CVE-2016-2041: Unsafe comparison of XSRF/CSRF token

  - CVE-2016-2042: Multiple full path disclosure     vulnerabilities

  - CVE-2016-2043: XSS vulnerability in normalization page

Several flaws were discovered in the CSRF authentication code of phpMyAdmin.

CVE-2016-2039

The XSRF/CSRF token is generated with a weak algorithm using functions that do not return cryptographically secure values.

CVE-2016-2041

The comparison of the XSRF/CSRF token parameter with the value saved in the session is vulnerable to timing attacks. Moreover, the comparison could be bypassed if the XSRF/CSRF token matches a particular pattern.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The phpMyAdmin development team reports :

The XSRF/CSRF token is generated with a weak algorithm using functions that do not return cryptographically secure values.

We consider this vulnerability to be non-critical.

ID	Name	Product	Family	Severity
92527	Debian DSA-3627-1 : phpmyadmin - security update	Nessus	Debian Local Security Checks	high
91243	Debian DLA-481-2 : phpmyadmin regression update	Nessus	Debian Local Security Checks	high
89630	Fedora 23 : phpMyAdmin-4.5.4.1-1.fc23 (2016-e55278763e)	Nessus	Fedora Local Security Checks	high
89625	Fedora 22 : phpMyAdmin-4.5.4-1.fc22 (2016-e1fe01e96e)	Nessus	Fedora Local Security Checks	high
9115	phpMyAdmin 4.0.x < 4.0.10.13 / 4.4.x < 4.4.15.3 / 4.5.x < 4.5.4 Multiple Vulnerabilities (PMASA-2016-1 - PMASA-2016-5)	Nessus Network Monitor	CGI	medium
88985	phpMyAdmin 4.0.x < 4.0.10.13 / 4.4.x < 4.4.15.3 / 4.5.x < 4.5.4 Multiple Vulnerabilities (PMASA-2016-1 - PMASA-2016-5)	Nessus	CGI abuses	high
88632	openSUSE Security Update : phpMyAdmin 4.4.15.4 (openSUSE-2016-168)	Nessus	SuSE Local Security Checks	high
88607	openSUSE Security Update : phpMyAdmin (openSUSE-2016-151)	Nessus	SuSE Local Security Checks	high
88492	Debian DLA-406-1 : phpmyadmin security update	Nessus	Debian Local Security Checks	high
88468	FreeBSD : phpmyadmin -- Unsafe generation of XSRF/CSRF token (60ab0e93-c60b-11e5-bf36-6805ca0b3d42)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2016-2039

medium

Tenable Plugins

high

high

high

high

medium

high

high

high

high

medium