phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to (1) libraries/phpseclib/Crypt/AES.php or (2) libraries/phpseclib/Crypt/Rijndael.php, which reveals the full path in an error message.

The phpMyAdmin application hosted on the remote web server is affected by multiple path disclosure vulnerabilities in multiple scripts. An unauthenticated, remote attacker can exploit these vulnerabilities, via a specially crafted request, to disclose the full path of the directory where phpMyAdmin is installed.

Note that phpMyAdmin is also reportedly affected by multiple cross-site scripting and cross-site request forgery vulnerabilities;
however, Nessus has not tested for these.

phpMyAdmin 4.5.4.1 (2016-01-28) =============================== - Error with PMA 4.4.15.3 - Remove hard dependency on phpseclib phpMyAdmin 4.5.4 (2016-01-28) ============================= - live data edit of big sets is not working - Table list not saved in db QBE bookmarked search - While 'changing a column', query fails with a syntax error after the 'CHARSET=' keyword - Avoid syntax error in JavaScript messages on invalid PHP setting for max_input_vars - Properly handle errors in upacking zip archive - Set PHP's internal encoding to UTF-8 - Fixed Kanji encoding in some specific cases - Check whether iconv works before using it - Avoid conversion of MySQL error messages - Undefined index: parameters - Undefined index:
field_name_orig - Undefined index: host - 'Add to central columns' (per column button) does nothing - SQL duplicate entry error trying to INSERT in designer_settings table - Fix handling of databases with dot in a name - Fix hiding of page content behind menu - FROM clause not generated after loading search bookmark - Fix creating/editing VIEW with DEFINER containing special chars - Do not invoke FLUSH PRIVILEGES when server in --skip- grant-tables - Misleading message for configuration storage - Table pagination does nothing when session expired - Index comments not working properly - Better handle local storage errors - Improve detection of privileges for privilege adjusting - Undefined property: stdClass::$releases at version check when disabled in config - SQL comment and variable stripped from bookmark on save - Gracefully handle errors in regex based JavaScript search - [Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-1 - [Security] Unsafe generation of CSRF token, see PMASA-2016-2 - [Security] Multiple XSS vulnerabilities, see PMASA-2016-3 - [Security] Insecure password generation in JavaScript, see PMASA-2016-4 - [Security] Unsafe comparison of CSRF token, see PMASA-2016-5 - [Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-6 - [Security] XSS vulnerability in normalization page, see PMASA-2016-7 - [Security] Full path disclosure vulnerability in SQL parser, see PMASA-2016-8 - [Security] XSS vulnerability in SQL editor, see PMASA-2016-9

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

phpMyAdmin 4.5.4 (2016-01-28) ============================= - live data edit of big sets is not working - Table list not saved in db QBE bookmarked search - While 'changing a column', query fails with a syntax error after the 'CHARSET=' keyword - Avoid syntax error in JavaScript messages on invalid PHP setting for max_input_vars - Properly handle errors in upacking zip archive - Set PHP's internal encoding to UTF-8 - Fixed Kanji encoding in some specific cases - Check whether iconv works before using it - Avoid conversion of MySQL error messages - Undefined index: parameters - Undefined index:
field_name_orig - Undefined index: host - 'Add to central columns' (per column button) does nothing - SQL duplicate entry error trying to INSERT in designer_settings table - Fix handling of databases with dot in a name - Fix hiding of page content behind menu - FROM clause not generated after loading search bookmark - Fix creating/editing VIEW with DEFINER containing special chars - Do not invoke FLUSH PRIVILEGES when server in --skip-grant-tables - Misleading message for configuration storage - Table pagination does nothing when session expired - Index comments not working properly - Better handle local storage errors - Improve detection of privileges for privilege adjusting - Undefined property: stdClass::$releases at version check when disabled in config - SQL comment and variable stripped from bookmark on save - Gracefully handle errors in regex based JavaScript search - [Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-1 - [Security] Unsafe generation of CSRF token, see PMASA-2016-2 - [Security] Multiple XSS vulnerabilities, see PMASA-2016-3 - [Security] Insecure password generation in JavaScript, see PMASA-2016-4 - [Security] Unsafe comparison of CSRF token, see PMASA-2016-5 - [Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-6 - [Security] XSS vulnerability in normalization page, see PMASA-2016-7 - [Security] Full path disclosure vulnerability in SQL parser, see PMASA-2016-8 - [Security] XSS vulnerability in SQL editor, see PMASA-2016-9

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of phpMyAdmin 4.4.x prior to 4.4.15.3, or 4.5.x prior to 4.5.4 are unpatched for the following vulnerabilities :

 - An information disclosure vulnerability exists in the 'AES.php' and 'Rijndael.php' scripts that allows a remote attacker, via a specially crafted request, to disclose the software's installation path. (CVE-2016-2042)
 - A cross-site scripting vulnerability exists due to improper validation of user-supplied input to the normalization script when handling a crafted table name before returning it to users. An authenticated, remote attacker can exploit this, via specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2016-2043)

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.4.x prior to 4.4.15.3 or 4.5.x prior to 4.5.4. It is, therefore, affected by the following vulnerabilities :

  - An information disclosure vulnerability exists in the     AES.php and Rijndael.php scripts that allows a remote     attacker, via a specially crafted request, to disclose     the software's installation path. (CVE-2016-2042)

  - A cross-site scripting vulnerability exists due to     improper validation of user-supplied input to the     normalization script when handling a crafted table name     before returning it to users. An authenticated, remote     attacker can exploit this, via specially crafted     request, to execute arbitrary script code in a user's     browser session. (CVE-2016-2043)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

Security update to phpMyAdmin 4.4.15.4

The followinng vulnerabilities were fixed: (boo#964024)

  - CVE-2016-2038: Multiple full path disclosure     vulnerabilities

  - CVE-2016-2039: Unsafe generation of XSRF/CSRF token

  - CVE-2016-2040: Multiple XSS vulnerabilities

  - CVE-2016-1927: Insecure password generation in     JavaScript

  - CVE-2016-2041: Unsafe comparison of XSRF/CSRF token

  - CVE-2016-2042: Multiple full path disclosure     vulnerabilities

  - CVE-2016-2043: XSS vulnerability in normalization page

This update to phpMyAdmin 4.4.15.4 fixes the following issues (boo#964024)

  - CVE-2016-2038: Multiple full path disclosure     vulnerabilities

  - CVE-2016-2039: Unsafe generation of XSRF/CSRF token

  - CVE-2016-2040: Multiple XSS vulnerabilities

  - CVE-2016-1927: Insecure password generation in     JavaScript

  - CVE-2016-2041: Unsafe comparison of XSRF/CSRF token

  - CVE-2016-2042: Multiple full path disclosure     vulnerabilities

  - CVE-2016-2043: XSS vulnerability in normalization page

The phpMyAdmin development team reports :

By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed.

We consider these vulnerabilities to be non-critical.

This path disclosure is possible on servers where the recommended setting of the PHP configuration directive display_errors is set to on, which is against the recommendations given in the PHP manual for a production server.

ID	Name	Product	Family	Severity
90428	phpMyAdmin Multiple Path Disclosure Vulnerabilities (PMASA-2016-1, PMASA-2016-6, PMASA-2016-8)	Nessus	CGI abuses	medium
89630	Fedora 23 : phpMyAdmin-4.5.4.1-1.fc23 (2016-e55278763e)	Nessus	Fedora Local Security Checks	high
89625	Fedora 22 : phpMyAdmin-4.5.4-1.fc22 (2016-e1fe01e96e)	Nessus	Fedora Local Security Checks	high
9116	phpMyAdmin 4.4.x < 4.4.15.3 / 4.5.x < 4.5.4 Multiple Vulnerabilities (PMASA-2016-6, PMASA-2016-7)	Nessus Network Monitor	CGI	low
88986	phpMyAdmin 4.4.x < 4.4.15.3 / 4.5.x < 4.5.4 Multiple Vulnerabilities (PMASA-2016-6, PMASA-2016-7)	Nessus	CGI abuses	medium
88632	openSUSE Security Update : phpMyAdmin 4.4.15.4 (openSUSE-2016-168)	Nessus	SuSE Local Security Checks	high
88607	openSUSE Security Update : phpMyAdmin (openSUSE-2016-151)	Nessus	SuSE Local Security Checks	high
88472	FreeBSD : phpmyadmin -- Multiple full path disclosure vulnerabilities (740badcb-c60b-11e5-bf36-6805ca0b3d42)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2016-2042

medium

Tenable Plugins

medium

high

high

low

medium

high

high

medium