Debian DLA-406-1 : phpmyadmin security update

Medium Nessus Plugin ID 88492

Synopsis

The remote Debian host is missing a security update.

Description

Several flaws were discovered in the CSRF authentication code of phpMyAdmin.

CVE-2016-2039

The XSRF/CSRF token is generated with a weak algorithm using functions that do not return cryptographically secure values.

CVE-2016-2041

The comparison of the XSRF/CSRF token parameter with the value saved in the session is vulnerable to timing attacks. Moreover, the comparison could be bypassed if the XSRF/CSRF token matches a particular pattern.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Upgrade the affected phpmyadmin package.

See Also

https://lists.debian.org/debian-lts-announce/2016/01/msg00031.html

https://packages.debian.org/source/squeeze-lts/phpmyadmin

Plugin Details

Severity: Medium

ID: 88492

File Name: debian_DLA-406.nasl

Version: 2.6

Type: local

Agent: unix

Published: 2016/02/01

Updated: 2018/07/06

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:phpmyadmin, cpe:/o:debian:debian_linux:6.0

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2016/01/30

Reference Information

CVE: CVE-2016-2039, CVE-2016-2041