http://bugzilla.suse.com/show_bug.cgi?id=994313
http://bugzilla.suse.com/show_bug.cgi?id=994313#c20
--- Comment #20 from Marcus Meissner ---
https://www.phpmyadmin.net/security/PMASA-2016-37/
PMASA-2016-37
Announcement-ID: PMASA-2016-37
Date: 2016-07-12
Summary
Path traversal with SaveDir and UploadDir
Description
A vulnerability was reported with the %u username replacement functionality of
the SaveDir and UploadDir features. When the username substitution is
configured, a specially-crafted user name can be used to circumvent
restrictions to traverse the file system.
Severity
We consider this vulnerability to be serious, however due to the mitigation
factors the default state is not vulnerable.
Mitigation factor
1) A system must be configured with the %u username replacement, such as
`$cfg['SaveDir'] = 'SaveDir_%u';` 2) The user must be able to create a
specially-crafted MySQL user, including the `/.` sequence of characters, such
as `/../../`
Affected Versions
All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and
4.0.x versions (prior to 4.0.10.17) are affected
Solution
Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, or 4.0.10.17 or newer or apply patch
listed below.
References
Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability.
Assigned CVE ids: CVE-2016-6614
CWE ids: CWE-661
Patches
The following commits have been made on the 4.0 branch to fix this issue:
c6cfb58
The following commits have been made on the 4.4 branch to fix this issue:
2989e49
The following commits have been made on the 4.6 branch to fix this issue:
5491d67
--
You are receiving this mail because:
You are on the CC list for the bug.