Padding Oracle Attack in phpMyAdmin Cookie Encryption (CVE-2016-6606)
Summary
CVE-2016-6606: An issue was discovered in cookie encryption in phpMyAdmin. Affects phpmyadmin across 61 version ranges.
< 1c1753bb6666381fa2cd2cd1f160286935244a35
< 1f1e63cd5956eca847891b28b24e90ceaeaeb009
< 1fe735d098d82ad79500eab04c4d25ba8fe25a24
< 2fecc279f5d51e00a203cd400ace24b6053969a4
< 3c96596f7d897e048be4c2c85d941aadd6141ba9
< 3df57a818917737d65e0e1c7cce80e9eb69e5e0b
< 3fc737460caa3c47d9d51751d712cc8784b1dfef
< 4.4.15.8-r0
< 5b0543da6915bac44cb15e7e73f9e1886fe57588
< 5b2b959a40ddd728d5ef4c6b09f118038c5e8af0
< 5e5261284190c6fe6985547fbd19d3345df14be1
< 6ab95d9bec50f6be6b5439abed35f99ab3fa5cbc
< 6da64cc3b2ba4439574f914f51e161645375be96
< 07fd0bce678e83d5f81d7a683f1052fe45764d0c
< 13a288d0da6e79b99acb9052bcf31b6650c624b5
< 21eda1c2c42d28370b91c99017dcee7eef9691fd
< 32f512698518214fcc59ea45e0f35b0aedff16cb
< 35e191d74b50c8f5a7b87fa9889869cc3a88255d
< 37b38431d167915675fc8ab512470528147e72de
< 52b6cfde9f581ee6818db0e3f5d80db8c29dfa34
< 64c2b9a59c09e4a04be2238553c3fcfbc58b7949
< 66aba31923f26124e06b2a55b837e4fd47c5ef1d
< 78a6214afcee3a6b65eb5e1ac261aa8e70f36736
< 86a7d2704994c43a4fae11cf38105fc3cb3d4d5b
< 243ed0268fa15567c8a787eeb6055a232102b91a
< 409c9bc50aa447c52d334c839f4aa239f66c5e03
< 426c5d9c1ded024c9306428ce165ae82d6f6d5df
< 00828f9ccb1024fbcd528f41dfdf28fab918dfff
< 2189c875356fc1af21c6da32235bf24f60f53b96
< 2694c36ef6e86de019196698a9de1953645fba97
< 5004dc40980b8dfe04c328abed85fde991833624
< 16136ea0ef224ed22c3dffd629e3e147579f5f38
< 82161a6c30a9ac2502d822e29cfb66beae7eeb4c
< 83416df64f2277d8853fcdd048df7bb154514d03
< 95104ff56e15876c6b481e09c9f0169e34b781f8
< 5118938f103e0022329847b654fcd99c8cb37de7
< 66149607b1b578bbedc0a90e3c000e8c410c7c8e
< a1b4ecc69bc4ac90a54e3f3c8644ca18f13b010d
< a62fcf03af4c7f9df2393fbe58ae8653166763fa
< a395665715a3f56db9692486d120fb1dc00bcc5d
< ad54449d105365dbbd39ae879306f1037fe238cd
< b0d60e271a6f47d2e0ecd81ad620b5d185acc0b1
< b1cc43ee7f8607c80889570912c5a54b7409b4d1
< b7c2e99987c2c52c6e8010b55b75f3c1c039216a
< b8f86592e900310f0b39d8e5270b26bebd0cfad8
< b478a3d5c4fc1341a0a77235d2afbd2b4e4d0a6c
< c68478ad7d0523e42aa789ba24ea5f9018510047
< c21937440af0b0b2ed752f229c3d2523ac178d85
< ceb7d7e1b2f8ab1e61710d0d061f10193a6c44c5
< d0f7dc79905f4795d328a018772871f9f98957fc
< d8f4a2d661f78281db7ee6826651ffc9574a2b31
< d81165f34555c5202d8150ae1d080834dd601d5b
< daf86cd1e369f63ad132d8dc63a7217267030408
< dba2af651a53d5037296a1dc827081a94ef1062c
< e0c1ed02a11b4ed46d82a31b7f95030854865add
< e4db51c0d47ac6e319ba93ce0d5706a33f736c00
< f2db92434b71973a1281dfbaec8837e51e602c77
< f7f483e99a74648843cc87265033442aeb4b7342
< f86761326c97eb5e2c9cefa2b1871252357f00a0
< f1668937772688de3bbd707cee23ef8653756f32
< fecf8b76ef831be0a5a8fddb1c3edf4251e92076
Fixed in 4.4.15.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular web-based database management tool written in PHP. It provides an intuitive interface for managing MySQL databases. The vulnerability identified as CVE-2016-6606 affects versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17) of phpMyAdmin. This vulnerability allows an attacker with access to a user's browser cookie file to decrypt the username and password stored in the cookie. Additionally, if a user has the same password as their username, an attacker can determine this by examining the cookie. The same initialization vector (IV) is used to hash the username and password, but the hashed values cannot be directly decoded from the cookie.
Vulnerability Detail
The vulnerability in phpMyAdmin's cookie encryption arises from a padding oracle attack. The decryption process used for the username and password is susceptible to this attack, allowing an attacker to decrypt the sensitive information. By exploiting this vulnerability, an attacker who gains access to a user's browser cookie file can retrieve the username and password. Furthermore, if the user's password is the same as their username, the attacker can deduce this information by analyzing the cookie. The IV used for hashing the username and password is shared, but the hashed values remain secure. This vulnerability affects multiple versions of phpMyAdmin, making it crucial for users to update to the fixed versions.
How To Fix
Minimum fixed version
4.4.15.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Users are advised to update to the fixed versions of phpMyAdmin as mentioned in the 'how_to_fix' section.
Conclusion
The padding oracle attack vulnerability in phpMyAdmin's cookie encryption can lead to the unauthorized decryption of usernames and passwords. It is crucial for users to update to the fixed versions of phpMyAdmin (4.6.4, 4.4.15.8-r0, or 4.0.10.17) to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for phpmyadmin →
FAQ
phpMyAdmin is a web-based database management tool for MySQL databases. It provides an intuitive interface for performing various database operations.
A padding oracle attack is a cryptographic attack that exploits the padding validation in encryption algorithms. By manipulating the padding, an attacker can decrypt encrypted data without knowing the encryption key.
An attacker with access to a user's browser cookie file can exploit this vulnerability by decrypting the username and password stored in the cookie. If the user's password is the same as their username, the attacker can determine this information by examining the cookie.
The consequences of this vulnerability include unauthorized access to sensitive information, such as usernames and passwords. This can lead to unauthorized access to the affected phpMyAdmin instances and potential compromise of the associated databases.
No, only versions 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17) are affected by this vulnerability. Users of other versions are not impacted.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
