MGASA-2016-0051

Dashboard / Vulnerabilities / MGASA-2016-0051

MGASA-2016-0051

Summary: Updated phpmyadmin/phpseclib packages fix security vulnerability

Details: Password suggestion functionality uses Math.random() which does not provide cryptographically secure random numbers (CVE-2016-1927). By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed (CVE-2016-2038). The XSRF/CSRF token is generated with a weak algorithm using functions that do not return cryptographically secure values (CVE-2016-2039). With a crafted table name it is possible to trigger an XSS attack in the database search page. With a crafted SET value or a crafted search query, it is possible to trigger an XSS attacks in the zoom search page. With a crafted hostname header, it is possible to trigger an XSS attacks in the home page (CVE-2016-2040). The comparison of the XSRF/CSRF token parameter with the value saved in the session is vulnerable to timing attacks. Moreover, the comparison could be bypassed if the XSRF/CSRF token matches a particular pattern (CVE-2016-2041). The phpmyadmin package has been updated to version 4.4.15.4 in the 4.4.x stable branch, and the phpseclib dependency has been updated to version 2.0.1.

References: https://advisories.mageia.org/MGASA-2016-0051.html, https://bugs.mageia.org/show_bug.cgi?id=17633, https://www.phpmyadmin.net/security/PMASA-2016-1/, https://www.phpmyadmin.net/security/PMASA-2016-2/, https://www.phpmyadmin.net/security/PMASA-2016-3/, https://www.phpmyadmin.net/security/PMASA-2016-4/, https://www.phpmyadmin.net/security/PMASA-2016-5/, https://www.phpmyadmin.net/files/4.4.15.3/, https://www.phpmyadmin.net/news/2016/1/28/phpmyadmin-454-44153-and-401013-are-released/, https://www.phpmyadmin.net/news/2016/1/29/phpmyadmin-401014-44154-and-451/, http://lwn.net/Vulnerabilities/674259/