CVE-2016-6632: phpMyAdmin Denial of Service (DOS) Attack with dbase Extension
Summary
CVE-2016-6632: phpMyAdmin Denial of service (DOS) attack with dbase extension. Affects phpmyadmin/phpmyadmin across 3 version ranges.
>= 4.0, < 4.0.10.17
>= 4.4, < 4.4.15.8
>= 4.6, < 4.6.4
Fixed in 4.0.10.17, 4.4.15.8 or 4.6.4, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Alpine:v3.2
The same CVE-2016-6632 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks, such as creating tables, executing queries, and managing user permissions. The dbase extension is a PHP extension that enables phpMyAdmin to import ESRI files. ESRI files are a type of geographic data format commonly used in GIS applications. This vulnerability affects multiple versions of phpMyAdmin, including 4.6.x, 4.4.x, and 4.0.x.
Vulnerability Detail
The vulnerability in phpMyAdmin allows for a denial of service (DOS) attack when importing ESRI files using the dbase extension. Under certain conditions, phpMyAdmin fails to delete temporary files created during the import process. This can lead to a buildup of temporary files, consuming disk space and potentially causing the server to become unresponsive. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0, < 4.0.10.174.0.10.17composer require phpmyadmin/phpmyadmin:4.0.10.17 -
>= 4.4, < 4.4.15.84.4.15.8composer require phpmyadmin/phpmyadmin:4.4.15.8 -
>= 4.6, < 4.6.44.6.4composer require phpmyadmin/phpmyadmin:4.6.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating phpMyAdmin is not immediately possible, users can manually delete the temporary files created during ESRI file imports. This can be done by locating the temporary file directory used by phpMyAdmin and removing any files with the '.tmp' extension. It is important to exercise caution when deleting files and ensure that only temporary files related to ESRI file imports are removed.
Conclusion
The phpMyAdmin vulnerability allows for a denial of service (DOS) attack when importing ESRI files using the dbase extension. To mitigate this vulnerability, users should update their phpMyAdmin installation to the latest version. Alternatively, temporary files created during ESRI file imports can be manually deleted. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
The dbase extension is a PHP extension that allows phpMyAdmin to import ESRI files, which are commonly used in GIS applications.
A denial of service (DOS) attack is an attempt to make a computer or network resource unavailable to its intended users, typically by overwhelming the target with a flood of incoming requests or by exploiting a vulnerability to consume system resources.
ESRI files are a type of geographic data format commonly used in GIS applications. They contain information about spatial data, such as maps, layers, and attributes.
This vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
