Bug 956401 (CVE-2013-3239)

Summary:	CVE-2013-3239 phpMyAdmin: remote code execution via locally saved SQL dump file multiple extensions (PMASA-2013-3)
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ccoleman, dmcphers, jialiu, lmeyer, redhat-bugzilla, tkramer
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	phpMyAdmin 3.5.8.1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-03-15 04:30:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	956403, 956404, 956405
Bug Blocks:	950112

Description Vincent Danen 2013-04-24 21:47:16 UTC

phpMyAdmin can be configured to save an export file on the web server, via its SaveDir directive. With this in place, it's possible, either via a crafted filename template or a crafted table name, to save a double extension file like foobar.php.sql. In turn, an Apache webserver on which there is no definition for the MIME type "sql" (the default) will treat this saved file as a ".php" script, leading to remote code execution.

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users to access the required form. Moreover, the SaveDir directive is empty by default, so a default configuration is not vulnerable. The $cfg['SaveDir'] directive must be configured, and the server must be running Apache with mod_mime to be exploitable.

This is fixed via the following commits:

https://github.com/phpmyadmin/phpmyadmin/commit/d3fafdfba0807068196655e9b6d16c5d1d3ccf8a
https://github.com/phpmyadmin/phpmyadmin/commit/1f6bc0b707002e26cab216b9e57b4d5de764de48

External References:

http://www.phpmyadmin.net/home_page/security/PMASA-2013-3.php

Comment 1 Vincent Danen 2013-04-24 21:51:53 UTC

Created phpMyAdmin tracking bugs for this issue

Affects: fedora-all [bug 956403]
Affects: epel-6 [bug 956404]

Comment 2 Vincent Danen 2013-04-24 21:51:55 UTC

Created phpMyAdmin3 tracking bugs for this issue

Affects: epel-5 [bug 956405]

Comment 3 Fedora Update System 2013-05-15 19:43:19 UTC

phpMyAdmin3-3.5.8.1-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2013-05-15 19:45:02 UTC

phpMyAdmin-3.5.8.1-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.