Debian DLA-406-1 : phpmyadmin security update

Medium Nessus Plugin ID 88492


The remote Debian host is missing a security update.


Several flaws were discovered in the CSRF authentication code of phpMyAdmin.


The XSRF/CSRF token is generated with a weak algorithm using functions that do not return cryptographically secure values.


The comparison of the XSRF/CSRF token parameter with the value saved in the session is vulnerable to timing attacks. Moreover, the comparison could be bypassed if the XSRF/CSRF token matches a particular pattern.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.


Upgrade the affected phpmyadmin package.

See Also

Plugin Details

Severity: Medium

ID: 88492

File Name: debian_DLA-406.nasl

Version: 2.7

Type: local

Agent: unix

Published: 2016/02/01

Updated: 2020/03/12

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:phpmyadmin, cpe:/o:debian:debian_linux:6.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2016/01/30

Reference Information

CVE: CVE-2016-2039, CVE-2016-2041