CVE-2016-9860: phpMyAdmin Denial of Service (DoS)
Summary
CVE-2016-9860: phpMyAdmin Denial of Service (DoS). Affects phpmyadmin/phpmyadmin across 3 version ranges.
>= 4.0, < 4.0.10.18
>= 4.4, < 4.4.15.9
>= 4.6, < 4.6.5
Fixed in 4.0.10.18, 4.4.15.9 or 4.6.5, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Alpine:v3.2
The same CVE-2016-9860 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database management tasks. The tool is widely used by developers, system administrators, and database administrators to interact with MySQL databases efficiently. However, a vulnerability has been discovered in phpMyAdmin that allows an unauthenticated user to execute a denial of service attack under specific conditions.
Vulnerability Detail
The vulnerability affects phpMyAdmin versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18) when the configuration option $cfg['AllowArbitraryServer'] is set to true. In such cases, an unauthenticated user can exploit the vulnerability to launch a denial of service attack against the phpMyAdmin instance. This can lead to the unavailability of the service and disrupt normal operations. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0, < 4.0.10.184.0.10.18composer require phpmyadmin/phpmyadmin:4.0.10.18 -
>= 4.4, < 4.4.15.94.4.15.9composer require phpmyadmin/phpmyadmin:4.4.15.9 -
>= 4.6, < 4.6.54.6.5composer require phpmyadmin/phpmyadmin:4.6.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, if upgrading to the fixed versions is not immediately feasible, it is recommended to set the configuration option $cfg['AllowArbitraryServer'] to false. This will disable the vulnerable functionality and mitigate the risk of a denial of service attack. However, this workaround may limit certain legitimate use cases, so upgrading to the fixed versions is still the recommended long-term solution.
Conclusion
The phpMyAdmin Denial of Service vulnerability (CVE-2016-9860) can be mitigated by upgrading to the fixed versions or applying the temporary workaround. Keeping the software up to date is crucial for maintaining the security and stability of the phpMyAdmin installation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool used for managing MySQL databases. It provides a web-based interface for performing various database management tasks.
The vulnerability allows an unauthenticated user to execute a denial of service attack against a phpMyAdmin instance, leading to service unavailability and disruption of normal operations.
The vulnerability affects phpMyAdmin versions 4.6.x (prior to 4.6.5), 4.4.x (prior to 4.4.15.9), and 4.0.x (prior to 4.0.10.18).
To fix the vulnerability, it is recommended to upgrade phpMyAdmin to the fixed versions: 4.6.5, 4.4.15.9, or 4.0.10.18.
Yes, a temporary workaround is to set the configuration option $cfg['AllowArbitraryServer'] to false. However, this may limit certain legitimate use cases.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
