The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

- update to 3.4.7.1 (fix for bnc#728243)

  - [security] Fixed possible local file inclusion in XML     import (CVE-2011-4107), see PMASA-2011-17     http://www.phpmyadmin.net/home_page/security/PMASA-2011-     17.php

According to its self-identified version number, the phpMyAdmin install hosted on the remote web server is affected by an information disclosure vulnerability.

The vulnerability, which is in the simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.3.x before 3.3.10.5 and 3.4.x before 3.4.7.1, allows remote, authenticated users to read arbitrary files via XML data containing external entity references.

Several vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2011-4107     The XML import plugin allowed a remote attacker to read     arbitrary files via XML data containing external entity     references.

  - CVE-2011-1940, CVE-2011-3181     Cross site scripting was possible in the table tracking     feature, allowing a remote attacker to inject arbitrary     web script or HTML.

The oldstable distribution (lenny) is not affected by these problems.

The remote host is affected by the vulnerability described in GLSA-201201-01 (phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in phpMyAdmin. Please       review the CVE identifiers and phpMyAdmin Security Advisories referenced       below for details.
  Impact :

    Remote attackers might be able to insert and execute PHP code, include       and execute local PHP files, or perform Cross-Site Scripting (XSS)       attacks via various vectors.
  Workaround :

    There is no known workaround at this time.

Changes for 3.4.7.1 (2011-11-10) :

  - [security] Fixed possible local file inclusion in XML     import (CVE-2011-4107)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jan Lieskovsky reports :

Importing a specially crafted XML file which contains an XML entity injection permits to retrieve a local file (limited by the privileges of the user running the web server).

ID	Name	Product	Family	Severity
74519	openSUSE Security Update : phpMyAdmin (openSUSE-2011-14)	Nessus	SuSE Local Security Checks	medium
59211	phpMyAdmin simplexml_load_string() Function Information Disclosure (PMASA-2011-17)	Nessus	CGI abuses	medium
57621	Debian DSA-2391-1 : phpmyadmin - several vulnerabilities	Nessus	Debian Local Security Checks	medium
57433	GLSA-201201-01 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
56926	Fedora 15 : phpMyAdmin-3.4.7.1-1.fc15 (2011-15846)	Nessus	Fedora Local Security Checks	medium
56925	Fedora 16 : phpMyAdmin-3.4.7.1-1.fc16 (2011-15841)	Nessus	Fedora Local Security Checks	medium
56924	Fedora 14 : phpMyAdmin-3.4.7.1-1.fc14 (2011-15831)	Nessus	Fedora Local Security Checks	medium
56804	FreeBSD : phpmyadmin -- Local file inclusion (1f6ee708-0d22-11e1-b5bd-14dae938ec40)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2011-4107

medium

Tenable Plugins

medium

medium

medium

critical

medium

medium

medium

medium