phpMyAdmin BLOB Streaming Multiple Input Validation Vulnerabilities
BID:34253
Info
phpMyAdmin BLOB Streaming Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 34253 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-1148 CVE-2009-1149 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 25 2009 12:00AM |
| Updated: | Apr 13 2015 09:55PM |
| Credit: | Manuel Lopez Gallego (Luisyana) and Santiago Rodríguez Collazo |
| Vulnerable: |
S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 phpMyAdmin phpMyAdmin 3.1.1 0 phpMyAdmin phpMyAdmin 3.1.1 .1 phpMyAdmin phpMyAdmin 3.1 .0 |
| Not Vulnerable: |
phpMyAdmin phpMyAdmin 3.1.3.1 |
Discussion
phpMyAdmin BLOB Streaming Multiple Input Validation Vulnerabilities
phpMyAdmin is prone to multiple input-validation vulnerabilities, including an HTTP response-splitting issue and a local file-include issue.
Attackers can leverage these issues to view or execute arbitrary local scripts or to misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust. Other attacks are also possible.
Versions prior to phpMyAdmin 3.1.3.1 are vulnerable.
phpMyAdmin is prone to multiple input-validation vulnerabilities, including an HTTP response-splitting issue and a local file-include issue.
Attackers can leverage these issues to view or execute arbitrary local scripts or to misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust. Other attacks are also possible.
Versions prior to phpMyAdmin 3.1.3.1 are vulnerable.
Exploit / POC
phpMyAdmin BLOB Streaming Multiple Input Validation Vulnerabilities
Attackers can exploit these issues via a browser. To exploit an HTTP response-splitting vulnerability, an attacker must entice a victim user to follow a malicious URI.
Attackers can exploit these issues via a browser. To exploit an HTTP response-splitting vulnerability, an attacker must entice a victim user to follow a malicious URI.
Solution / Fix
phpMyAdmin BLOB Streaming Multiple Input Validation Vulnerabilities
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
phpMyAdmin BLOB Streaming Multiple Input Validation Vulnerabilities
References:
References:
- phpMyAdmin Homepage (phpMyAdmin)
- PMASA-2009-1 HTTP Response Splitting and file inclusion vulnerability (phpMyAdmin)