http://bugzilla.suse.com/show_bug.cgi?id=994313
http://bugzilla.suse.com/show_bug.cgi?id=994313#c10
--- Comment #10 from Marcus Meissner ---
https://www.phpmyadmin.net/security/PMASA-2016-47/
PMASA-2016-47
Announcement-ID: PMASA-2016-47
Date: 2016-07-21
Summary
IPv6 and proxy server IP-based authentication rule circumvention
Description
A vulnerability was discovered where, under certain circumstances, it may be
possible to circumvent the phpMyAdmin IP-based authentication rules.
When phpMyAdmin is used with IPv6 in a proxy server environment, and the proxy
server is in the allowed range but the attacking computer is not allowed, this
vulnerability can allow the attacking computer to connect despite the IP rules.
Severity
We consider this vulnerability to be serious
Mitigation factor
* The phpMyAdmin installation must be running with IP-based allow/deny rules *
The phpMyAdmin installation must be running behind a proxy server (or proxy
servers) where the proxy server is "allowed" and the attacker is "denied" * The
connection between the proxy server and phpMyAdmin must be via IPv6
Affected Versions
All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and
4.0.x versions (prior to 4.0.10.17) are affected
Solution
Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, or 4.0.10.17 or newer or apply patch
listed below.
References
Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability.
Assigned CVE ids: CVE-2016-6624
CWE ids: CWE-661
Patches
The following commits have been made on the 4.0 branch to fix this issue:
4440790
The following commits have been made on the 4.4 branch to fix this issue:
e291300
The following commits have been made on the 4.6 branch to fix this issue:
6aacd7d
--
You are receiving this mail because:
You are on the CC list for the bug.