phpMyAdmin Insecure Temporary File and Directory Creation Vulnerabilities
BID:37826
Info
phpMyAdmin Insecure Temporary File and Directory Creation Vulnerabilities
| Bugtraq ID: | 37826 |
| Class: | Design Error |
| CVE: |
CVE-2008-7251 CVE-2008-7252 |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 15 2010 12:00AM |
| Updated: | Apr 19 2010 12:32PM |
| Credit: | Thijs Kinkhorst |
| Vulnerable: |
S.u.S.E. openSUSE 11.0 phpMyAdmin phpMyAdmin 2.11.9 4 phpMyAdmin phpMyAdmin 2.11.9 .6 phpMyAdmin phpMyAdmin 2.11.9 .2 phpMyAdmin phpMyAdmin 2.11.9 .1 phpMyAdmin phpMyAdmin 2.11.9 phpMyAdmin phpMyAdmin 2.11.8 phpMyAdmin phpMyAdmin 2.11.7 phpMyAdmin phpMyAdmin 2.11.5 phpMyAdmin phpMyAdmin 2.11.4 phpMyAdmin phpMyAdmin 2.11.1 phpMyAdmin phpMyAdmin 2.11.9.5. phpMyAdmin phpMyAdmin 2.11.9.5 phpMyAdmin phpMyAdmin 2.11.9.3 phpMyAdmin phpMyAdmin 2.11.8.1 phpMyAdmin phpMyAdmin 2.11.5.2 phpMyAdmin phpMyAdmin 2.11.5.1 phpMyAdmin phpMyAdmin 2.11.2.2 phpMyAdmin phpMyAdmin 2.11.2.1 phpMyAdmin phpMyAdmin 2.11.1.2 phpMyAdmin phpMyAdmin 2.11.1.1 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 |
| Not Vulnerable: |
phpMyAdmin phpMyAdmin 2.11.10 |
Discussion
phpMyAdmin Insecure Temporary File and Directory Creation Vulnerabilities
phpMyAdmin creates temporary directories and files in an insecure way.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.
Successful attacks may corrupt data or cause denial-of-service conditions. Other unspecified attacks are also possible.
This issue affects phpMyAdmin 2.11.x (prior to 2.11.10.)
phpMyAdmin creates temporary directories and files in an insecure way.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.
Successful attacks may corrupt data or cause denial-of-service conditions. Other unspecified attacks are also possible.
This issue affects phpMyAdmin 2.11.x (prior to 2.11.10.)
Exploit / POC
phpMyAdmin Insecure Temporary File and Directory Creation Vulnerabilities
An attacker can use readily available commands to exploit this issue.
An attacker can use readily available commands to exploit this issue.
Solution / Fix
phpMyAdmin Insecure Temporary File and Directory Creation Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Debian Linux 5.0 ia-64
Debian Linux 5.0 alpha
Debian Linux 5.0 ia-32
Debian Linux 5.0 s/390
Debian Linux 5.0 mipsel
Debian Linux 5.0 hppa
Debian Linux 5.0 m68k
Debian Linux 5.0 arm
Debian Linux 5.0 armel
Debian Linux 5.0
MandrakeSoft Corporate Server 4.0
Debian Linux 5.0 amd64
Debian Linux 5.0 mips
Debian Linux 5.0 powerpc
Debian Linux 5.0 sparc
MandrakeSoft Corporate Server 4.0 x86_64
Solution:
Updates are available. Please see the references for more information.
Debian Linux 5.0 ia-64
-
Debian phpmyadmin_2.11.8.1-5+lenny4_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny4_all.deb
Debian Linux 5.0 alpha
-
Debian phpmyadmin_2.11.8.1-5+lenny4_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny4_all.deb
Debian Linux 5.0 ia-32
-
Debian phpmyadmin_2.11.8.1-5+lenny4_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny4_all.deb
Debian Linux 5.0 s/390
-
Debian phpmyadmin_2.11.8.1-5+lenny4_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny4_all.deb
Debian Linux 5.0 mipsel
-
Debian phpmyadmin_2.11.8.1-5+lenny4_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny4_all.deb
Debian Linux 5.0 hppa
-
Debian phpmyadmin_2.11.8.1-5+lenny4_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny4_all.deb
Debian Linux 5.0 m68k
-
Debian phpmyadmin_2.11.8.1-5+lenny4_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny4_all.deb
Debian Linux 5.0 arm
-
Debian phpmyadmin_2.11.8.1-5+lenny4_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny4_all.deb
Debian Linux 5.0 armel
-
Debian phpmyadmin_2.11.8.1-5+lenny4_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny4_all.deb
Debian Linux 5.0
-
Debian phpmyadmin_2.11.8.1-5+lenny4_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny4_all.deb
MandrakeSoft Corporate Server 4.0
-
Mandriva phpMyAdmin-2.11.10-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/
Debian Linux 5.0 amd64
-
Debian phpmyadmin_2.11.8.1-5+lenny4_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny4_all.deb
Debian Linux 5.0 mips
-
Debian phpmyadmin_2.11.8.1-5+lenny4_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny4_all.deb
Debian Linux 5.0 powerpc
-
Debian phpmyadmin_2.11.8.1-5+lenny4_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny4_all.deb
Debian Linux 5.0 sparc
-
Debian phpmyadmin_2.11.8.1-5+lenny4_all.deb
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2 .11.8.1-5+lenny4_all.deb
MandrakeSoft Corporate Server 4.0 x86_64
-
Mandriva phpMyAdmin-2.11.10-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/
References
phpMyAdmin Insecure Temporary File and Directory Creation Vulnerabilities
References:
References:
- phpMyAdmin Homepage (phpMyAdmin)
- PMASA-2010-1 (phpMyAdmin)
- PMASA-2010-2 (phpMyAdmin)