Developers August 2002

developers@phpmyadmin.net

22 participants
54 discussions

[Phpmyadmin-devel] MAJOR security hole
by Robin Johnson 14 Aug '02

14 Aug '02

Hi Guys, I've just had a major security hole reported to me by Colin Keigher (AnimeFreak) <animefreak(a)users.sourceforge.net> It relates to how some sites have PMA set up (they have username and password hardcoded, without any .htaccess protection). Basically, by searching on Google for "Welcome to phpMyAdmin" or it's translated equivilents, you can find a lot of PMA installations. You can put the version number in there as well, like "Welcome to phpMyAdmin 2.3.0-rc1" Here is a sample URL to search: http://www.google.ca/search?hl=en&ie=UTF-8&oe=UTF-8&q=%22Welcome+to+phpMyAd… With using some of these URL's you can do stuff like: http://www1.tsimtung.com/phpMyAdmin/sql.php?goto=/etc/passwd&btnDrop=No Here is a front page: http://garfield.vet.fnt.hvu.nl/counter/myadmin/ And other nefarious things. I found a few sites where I could access their entire database with full rights, even some where they have configured the user to root and I could change the mysql database. This is what we need to do to fix it: 1. All served up pages should contain directives to instruct search robots not to index the files. This will stop so many sites being listed in the search engines. 2. We should deprecate the user/password standard login, or add a bit of technology to it. We should throw up a login page of our own, that should authenticate against a user/password pair in an array inside the configuration file. It might be possible to keep the automatic login of user/password, but it should not be enabled by default, for security. And the configuration option to turn that unsecure method back on should have huge warnings around it. -- Robin Hugh Johnson E-Mail : robbat2(a)orbis-terrarum.net Home Page : http://www.orbis-terrarum.net/?l=people.robbat2 ICQ# : 30269588 or 41961639

5 11

[Phpmyadmin-devel] phpMyAdmin 2.2.7-pl1 is released
by Rabus 13 Aug '02

13 Aug '02

Hi, the phpMyAdmin project team has just released a patch level 1 for phpMyAdmin 2.2.7. The patch fixes an XHTML issue as it is explained in this report: http://sourceforge.net/tracker/?func=detail&atid=377408&aid=594031&group_id= 23067 The fixed version 2.2.7-pl1 is available on our project homepage at http://www.phpmyadmin.net Regards, Alexander M. Turek for the phpMyAdmin dev team.

2 1

[Phpmyadmin-devel] Fw: phpMyAdmin and MDB/Metabase
by Rabus 13 Aug '02

13 Aug '02

Hi list, please read this mail I recieved a few hours ago. Alexander ----- Original Message ----- From: "Lukas Smith" <smith(a)dybnet.de> To: <rabus(a)bugfixes.info> Sent: Tuesday, August 13, 2002 12:12 AM Subject: phpMyAdmin and MDB/Metabase Hi, I am the author of MDB (http://cvs.php.net/co.php/pear/MDB/Readme.txt?r=1.17) MDB (taken from Metabase) features an RDBMS independent xml schema management. I am getting close to a 1.0 release of MDB this month. But the xml schema format has been stable for quite some time. It would be cool if there would be some cooperation with the phpMyAdmin project. Anyways something that MDB supports which Metabase only currently has in beta is reverse engineering of existing databases (currently only for MySQL). Since its impossible to perfectly map MySQL datatypes to MDB datatypes (for example is int(1) just an integer field with length 1 or actually a Boolean field). So there needs to be some "interactive" app to handle this. This is just one area where I could see cooperation. Another would be to use MDB's schema management features (dumping to and updating from an xml schema) or displaying MDB types instead of MySQL types. I know the scope of MDB is beyond "just" MySQL. I don't know how close the cooperation is with the other php*Admin projects. But this is obviously something where cooperation would be great. I am mailing you because according to the credits you were responsible to the current xml dump code. If this proposal does not interest you, yet you know someone that more be interested please forward this mail to this person. Thx in advance .. Regards, Lukas Smith smith(a)dybnet.de _______________________________ DybNet Internet Solutions GbR Reuchlinstr. 10-11 Gebäude 4 1.OG Raum 6 (4.1.6) 10553 Berlin Germany Tel. : +49 30 83 22 50 00 Fax : +49 30 83 22 50 07 www.dybnet.de info(a)dybnet.de

1 0

[Phpmyadmin-devel] bugfix for 2.2.7
by Rabus 13 Aug '02

13 Aug '02

Hi list, There is a serious bug in 2.2.7 (#594031) that makes this version partly useless. I have already merged the fix in CVS: sql.php3 is the only file that is affected. Would it be possible to release a 2.2.7-pl1 silently with the corrected file inside? I'm sorry for that. I really don't know how such a stupid bug could get into the code. Alexander

3 7

Re: [Phpmyadmin-devel] Re: MAJOR security hole
by "Thomas Bähr [Office]" 13 Aug '02

13 Aug '02

At 13:12 12.08.2002 -0700, you wrote: >On Mon, 12 Aug 2002, Marc Delisle wrote: > > > On Mon, 12 Aug 2002, Marc Delisle wrote: > > > > > I've just merged a fix against that, but it needs some testing > since I do > > > > > not have a machine here which is affected by this securety hole. > > > > you won't like me, but I think we should wait to include a fix for a > > > > "hole" until a developer can reproduce it. > > > > > > I'm going to set up a copy of PMA that exhibits the security hole for us > > > to test out bug. Give me a day or two, as I have some more pressing work > > > at the moment. > > Robin, > > > > the "goto" problem? > > > > Marc >I've checked out the goto problem, and you were right, it is fixed in the >recent releases. It now limits you to files only in the phpMyAdmin install >directory. Which can still be a problem in itself I think. > >On checking out the other problem with systems totally open using the >config mechanism, try out this series of SQL Commands: > >First time around: >CREATE TABLE testB ( t mediumtext ); >LOAD DATA INFILE '/home/robbat2/public_html/PMA/config.inc.php' INTO TABLE >testB FIELDS TERMINATED BY '\n' LINES TERMINATED BY '\n'; > >Where you need to change the path of the file, and the 'TERMINATED BY' >parts for your own systems. > >When that completes, >I ran this: >SELECT * FROM testB WHERE t like '%Server%' AND (t like '%user%' or t like >'%password%'); > >To get just the PMA authentication data. > >Of course, this exploit requires that the user have the FILE privilege. AND Create Rights on MYSQL as well ;-)) at least somethere ;-) >This would apply to all cases where PMA has been set up with the user as >root, or anybody else with the FILE privilege. > >I'm carrying on looking for more holes along these lines. > >-- >Robin Hugh Johnson >E-Mail : robbat2(a)orbis-terrarum.net >Home Page : http://www.orbis-terrarum.net/?l=people.robbat2 >ICQ# : 30269588 or 41961639 > > > >------------------------------------------------------- >This sf.net email is sponsored by: Dice - The leading online job board >for high-tech professionals. Search and apply for tech jobs today! >http://seeker.dice.com/seeker.epl?rel_code=31 >_______________________________________________ >Phpmyadmin-devel mailing list >Phpmyadmin-devel(a)lists.sourceforge.net >https://lists.sourceforge.net/lists/listinfo/phpmyadmin-devel

1 0

[Phpmyadmin-devel] Parse error in chinese_gb-utf8 translation
by Lo�c 12 Aug '02

12 Aug '02

Hi again! I have just run the "scripts/check_lang.php3" script and found a parse error in the chinese gb utf translation: a quote is missing at the end of the "$strBeginCut" string. Loïc ______________________________________________________________________________ Pour mieux recevoir vos emails, utilisez un PC plus performant ! Découvrez la nouvelle gamme DELL en exclusivité sur i (france) http://www.ifrance.com/_reloc/signhdell

4 4

[Phpmyadmin-devel] Re: MAJOR security hole
by Lo�c 12 Aug '02

12 Aug '02

Hi List! > I've just had a major security hole reported to me by > Colin Keigher (AnimeFreak) <animefreak(a)users.sourceforge.net> > It relates to how some sites have PMA set up (they have username > and password hardcoded, without any .htaccess protection). Well it's not really a phpMyAdmin security hole. It's up to the user to take care about such a problem. Maybe we can add some words about the way to build an ".htaccess" file in the documentation. > With using some of these URL's you can do stuff like: > http://www1.tsimtung.com/phpMyAdmin/sql.php?goto=/etc/passwd&btnDrop=No As far as I remember, this issue has been fixed a long time ago. A report about this problem were written by SecureReality and we fixed it just after the 2.1.0 release. Loïc ______________________________________________________________________________ Pour mieux recevoir vos emails, utilisez un PC plus performant ! Découvrez la nouvelle gamme DELL en exclusivité sur i (france) http://www.ifrance.com/_reloc/signhdell

1 0

[Phpmyadmin-devel] "new laguages" info on phpmyadmin.net
by Rabus 12 Aug '02

12 Aug '02

Hi list, I've just read the release notes on phpmyadmin.net: "new languages: slovenian, afrikaans, hindi" There's a fourth new language in 2.2.7 and 2.3.0: albanian. Alexander

2 1

Re: [Phpmyadmin-devel] Re: MAJOR security hole
by "Thomas Bähr [Office]" 12 Aug '02

12 Aug '02

Hi Robin an the others, >http://www.google.ca/search?hl=en&ie=UTF-8&oe=UTF-8&q=%22Welcome+to+phpMyAdm >in+2.3.0%22&meta= > > > > With using some of these URL's you can do stuff like: > > http://www1.tsimtung.com/phpMyAdmin/sql.php?goto=/etc/passwd&btnDrop=No > >I've just merged a fix against that, but it needs some testing since I do >not have a machine here which is affected by this securety hole. >*G* that has been a very stupid function in the first case .. one should always watch security than coding such stuff >I did not check how you fixed that but I guess the easiest way whould be to add $cfg[PmaAsoluteUri] to the $is_gotofile var >so the above would result in "http://www1.tsimtung.com/phpMyAdmin/etc/passwd" an therefor fail ;-) Upps sorry wrong var *G* it should be the filesystem path to PMA and not the URL path to PMA ;-)))) Thomas

1 0

FW: [Phpmyadmin-devel] Re: MAJOR security hole
by Beck, Mike 12 Aug '02

12 Aug '02

> Could we detect a .htaccess protection? > If so, let's display a big red warning if someone uses the > config auth mode > without a .htaccess protection... > > Alexander > we could detect if HTTP_AUTH_USER is set also: is a robots.txt file only searched for in the main directory of a domain or can it also be in subdirectories? if it can be then we could also put a robots.txt file in the dist that disallows robots to go there. -- Mike Beck mike.beck(a)users.sourceforge.net

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

Developers August 2002