Security Update for phpmyadmin in Debian 7 Wheezy
Summary
DLA-757-1: phpmyadmin - security update. Affects phpmyadmin versions < 4:3.4.11.1-2+deb7u7. Fixed in 4:3.4.11.1-2+deb7u7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases. It provides a web-based interface that allows users to perform various database administration tasks. The phpmyadmin package in Debian 7 Wheezy is vulnerable to multiple security issues that have been identified and fixed.
Vulnerability Detail
The vulnerabilities in phpmyadmin include:
-
CVE-2016-4412 / PMASA-2016-57: A user can be tricked into following a link that leads to phpMyAdmin, which then redirects to a malicious site after authentication.
-
CVE-2016-6626 / PMASA-2016-49: The fix for PMASA-2016-57 lacked sufficient checking, allowing bypassing of the whitelist.
-
CVE-2016-9849 / PMASA-2016-60: Null Byte can be used to bypass username deny rules (AllowRoot & Others).
-
CVE-2016-9850 / PMASA-2016-61: Username matching for allow/deny rules may result in wrong matches and detection of the username in the rule due to non-constant execution time.
-
CVE-2016-9861 / PMASA-2016-66: The fix for PMASA-2016-49 had buggy checks, enabling bypassing of the whitelist.
-
CVE-2016-9864 / PMASA-2016-69: Multiple SQL injection vulnerabilities.
-
CVE-2016-9865 / PMASA-2016-70: A bug in serialized string parsing allows bypassing the protection offered by the PMA_safeUnserialize() function.
How To Fix
Minimum fixed version
4:3.4.11.1-2+deb7u7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
phpmyadmin in Debian 7 Wheezy has been found to have multiple security vulnerabilities. It is crucial to upgrade to version 4:3.4.11.1-2+deb7u7 to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases. It provides a web-based interface for performing various database administration tasks.
The vulnerabilities in phpmyadmin include issues such as user redirection to malicious sites, bypassing of whitelist, username deny rules bypass using Null Byte, incorrect username matching for allow/deny rules, SQL injection vulnerabilities, and bypassing of serialized string parsing protection.
To fix these vulnerabilities, you should upgrade the phpmyadmin package to version 4:3.4.11.1-2+deb7u7. This can be done by running the package manager update command for Debian 7 Wheezy.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to apply the security update as soon as possible.
You can find more information about Debian LTS security advisories, how to apply updates, and frequently asked questions at the Debian LTS wiki.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
