Detections
Analytics
Debian DLA-551-1 : phpmyadmin security update
high Nessus Plugin ID 92326
Language:
Synopsis
The remote Debian host is missing a security update.Description
Phpmyadmin, a web administration tool for MySQL, had several Cross Site Scripting (XSS) vulnerabilities were reported.CVE-2016-5731
With a specially crafted request, it is possible to trigger an XSS attack through the example OpenID authentication script.
CVE-2016-5733
Several XSS vulnerabilities were found with the Transformation feature. Also a vulnerability was reported allowing a specifically- configured MySQL server to execute an XSS attack. This particular attack requires configuring the MySQL server log_bin directive with the payload.
CVE-2016-5739
A vulnerability was reported where a specially crafted Transformation could be used to leak information including the authentication token.
This could be used to direct a CSRF attack against a user.
For Debian 7 'Wheezy', these problems have been fixed in version 4:3.4.11.1-2+deb7u5.
We recommend that you upgrade your phpmyadmin packages.
NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Upgrade the affected phpmyadmin package.See Also
https://lists.debian.org/debian-lts-announce/2016/07/msg00013.html
Plugin Details
Severity: High
ID: 92326
File Name: debian_DLA-551.nasl
Version: 2.7
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 7/18/2016
Updated: 1/11/2021
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:phpmyadmin, cpe:/o:debian:debian_linux:7.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 7/17/2016