- Developers - lists.phpmyadmin.net

Re: [Phpmyadmin-devel] MOPB-02-2007 deep recursion,
by Marc Delisle 02 Mar '07

02 Mar '07

Sebastian Mendel a écrit : > Marc Delisle schrieb: >> curl http://localhost/phpmyadmin/?`php -r 'for ($i=1; $i < 1000; $i++) >> {echo "x" . $i . "=a&";}'` >> >> -> URI too long >> >> curl http://localhost/phpmyadmin/?`php -r 'for ($i=1; $i < 1000; $i++) >> {echo "x" . $i . "=a&";}'` >> >> -> login form >> >> curl http://localhost/phpmyadmin/?`php -r 'for ($i=1; $i < 1000; $i++) >> {echo "x" . $i . "=1&";}'` >> >> -> URI too long > > works for me: > > deep_recusrion.php > <?php > echo 'register_globals: ' . ini_get('register_globals'); > echo '<hr />'; > echo '<a href="?'; > for ($i = 1; $i < 1010; $i++) {echo "x" . $i . "=a&";} > echo '">klick to test protection against 1000+ vars</a>'; > echo '<hr />'; > > if (count($GLOBALS) > 1000) { > die('deep recursion attack'); > } > ?> > > I wrote that I was testing an unpatched PMA. I'm not saying that our "if" does not work, I'm saying that I don't see the goal of checking the size of $GLOBALS. Marc

2 3

Re: [Phpmyadmin-devel] MOPB-02-2007 deep recursion,
by Marc Delisle 02 Mar '07

02 Mar '07

Sebastian Mendel a écrit : > Marc Delisle schrieb: >> Sebastian Mendel a écrit : >>> Marc Delisle schrieb: >>>> Sebastian Mendel a écrit : >>>>> Marc Delisle schrieb: >>>>>> Sebastian Mendel a écrit : >>>>>>> Marc Delisle schrieb: >>>>>>>> Sebastian, >>>>>>>> >>>>>>>> this part of the patch: >>>>>>>> /** >>>>>>>> + * protect against deep recursion attack CVE-2006-1549, >>>>>>>> + * 1000 seems to be more than enough >>>>>>>> + * >>>>>>>> + * @see http://www.php-security.org/MOPB/MOPB-02-2007.html >>>>>>>> + * @see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1549 >>>>>>>> + */ >>>>>>>> +if (count($GLOBALS) > 1000) { >>>>>>>> + die('possible deep recurse attack'); >>>>>>>> +} >>>>>>>> >>>>>>>> is not reached when I test the attack of MOPB-02, it's the other >>>>>>>> part that protects for this attack. >>>>>>>> >>>>>>>> Do you know in which case this code would trigger? In the case of an >>>>>>>> attempt to override $GLOBALS? >>>>>>> it should trigger if and only if register_globals is on >>>>>> I cannot make this code trigger when register_globals is on, >>>>>> it's always the protection in PMA_arrayWalkRecursive() that triggers. >>>>>> >>>>>> I'm attacking with >>>>>> curl http://127.0.0.1/phpmyadmin/ -d a`php -r 'echo >>>>>> str_repeat("[a]",20000);'`=1 >>>>>> >>>>>> do you have some other attack in mind? >>>>> this will trigger with >>>>> >>>>> phpmyadmin/?1=1;2=2;3=3;...;100000=100000 >>>>> >>>>> this would also be triggered inside PMA_arrayWalkRecursive() but at this >>>>> point we could have allready iterated over $GLOBALS ... >>>>> >>>>> >>>> Thanks for the clarification. I tried to trigger this (with >>>> register_globals On) >>>> >>>> curl http://localhost/phpmyadmin/?`php -r 'for ($i=1; $i < 10000; $i++) >>>> {echo "$i=$i;";}'` >>>> >>>> I got: >>>> <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> >>>> <HTML><HEAD> >>>> <TITLE>414 Request-URI Too Large</TITLE> >>>> </HEAD><BODY> >>>> <H1>Request-URI Too Large</H1> >>>> The requested URL's length exceeds the capacity >>>> limit for this server.<P> >>>> request failed: URI too long<P> >>>> >>>> ========= >>>> >>>> With less values: >>>> curl http://localhost/phpmyadmin/?`php -r 'for ($i=1; $i < 10000; $i++) >>>> {echo "$i=$i;";}'` >>>> >>>> numeric key detected >>>> -------- >>>> >>>> Ok let's try something else: >>>> >>>> curl http://localhost/phpmyadmin/?`php -r >>>> 'for ($i=1; $i < 1000; $i++) {echo "x" . $i . "=$i;";}'` >>> curl http://localhost/phpmyadmin/?`php -r >>> 'for ($i=1; $i < 1000; $i++) {echo "x" . $i . "=a;";}'` >> This returns the HTML for the login form. > > uh, of course you have to use & instead of ; if your configuration says so > > curl http://localhost/phpmyadmin/?`php -r > 'for ($i=1; $i < 1000; $i++) {echo "x" . $i . "=a&";}'` > > >> Since we are testing the GET parameters, this might be good to test: >> >> curl http://localhost/phpmyadmin/?`php -r 'for ($i=1; $i < 1000; $i++) >> {echo "x" . $i . "=$i&";}'` >> >> or >> curl http://localhost/phpmyadmin/?`php -r 'for ($i=1; $i < 1000; $i++) >> {echo "x" . $i . "=$i&";}'` >> >> both return "URI too long". > > > as above, replace the second $i with a or 1 or ... > > curl http://localhost/phpmyadmin/?`php -r 'for ($i=1; $i < 1000; $i++) {echo "x" . $i . "=a&";}'` -> URI too long curl http://localhost/phpmyadmin/?`php -r 'for ($i=1; $i < 1000; $i++) {echo "x" . $i . "=a&";}'` -> login form curl http://localhost/phpmyadmin/?`php -r 'for ($i=1; $i < 1000; $i++) {echo "x" . $i . "=1&";}'` -> URI too long

1 0

Re: [Phpmyadmin-devel] MOPB-02-2007 deep recursion,
by Marc Delisle 02 Mar '07

02 Mar '07

Sebastian Mendel a écrit : > Marc Delisle schrieb: >> Sebastian Mendel a écrit : >>> Marc Delisle schrieb: >>>> Sebastian Mendel a écrit : >>>>> Marc Delisle schrieb: >>>>>> Sebastian, >>>>>> >>>>>> this part of the patch: >>>>>> /** >>>>>> + * protect against deep recursion attack CVE-2006-1549, >>>>>> + * 1000 seems to be more than enough >>>>>> + * >>>>>> + * @see http://www.php-security.org/MOPB/MOPB-02-2007.html >>>>>> + * @see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1549 >>>>>> + */ >>>>>> +if (count($GLOBALS) > 1000) { >>>>>> + die('possible deep recurse attack'); >>>>>> +} >>>>>> >>>>>> is not reached when I test the attack of MOPB-02, it's the other >>>>>> part that protects for this attack. >>>>>> >>>>>> Do you know in which case this code would trigger? In the case of an >>>>>> attempt to override $GLOBALS? >>>>> it should trigger if and only if register_globals is on >>>> I cannot make this code trigger when register_globals is on, >>>> it's always the protection in PMA_arrayWalkRecursive() that triggers. >>>> >>>> I'm attacking with >>>> curl http://127.0.0.1/phpmyadmin/ -d a`php -r 'echo >>>> str_repeat("[a]",20000);'`=1 >>>> >>>> do you have some other attack in mind? >>> this will trigger with >>> >>> phpmyadmin/?1=1;2=2;3=3;...;100000=100000 >>> >>> this would also be triggered inside PMA_arrayWalkRecursive() but at this >>> point we could have allready iterated over $GLOBALS ... >>> >>> >> Thanks for the clarification. I tried to trigger this (with >> register_globals On) >> >> curl http://localhost/phpmyadmin/?`php -r 'for ($i=1; $i < 10000; $i++) >> {echo "$i=$i;";}'` >> >> I got: >> <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> >> <HTML><HEAD> >> <TITLE>414 Request-URI Too Large</TITLE> >> </HEAD><BODY> >> <H1>Request-URI Too Large</H1> >> The requested URL's length exceeds the capacity >> limit for this server.<P> >> request failed: URI too long<P> >> >> ========= >> >> With less values: >> curl http://localhost/phpmyadmin/?`php -r 'for ($i=1; $i < 10000; $i++) >> {echo "$i=$i;";}'` >> >> numeric key detected >> -------- >> >> Ok let's try something else: >> >> curl http://localhost/phpmyadmin/?`php -r >> 'for ($i=1; $i < 1000; $i++) {echo "x" . $i . "=$i;";}'` > > curl http://localhost/phpmyadmin/?`php -r > 'for ($i=1; $i < 1000; $i++) {echo "x" . $i . "=a;";}'` This returns the HTML for the login form. Since we are testing the GET parameters, this might be good to test: curl http://localhost/phpmyadmin/?`php -r 'for ($i=1; $i < 1000; $i++) {echo "x" . $i . "=$i&";}'` or curl http://localhost/phpmyadmin/?`php -r 'for ($i=1; $i < 1000; $i++) {echo "x" . $i . "=$i&";}'` both return "URI too long". Note that I am testing with an unpatched PMA. Marc

1 0

[Phpmyadmin-devel] external contact
by Sebastian Mendel 02 Mar '07

02 Mar '07

Hi, today i asked steffen something about his bug-reports, i noticed that marc already asked him the same ... ;-) possible we should add bcc: pma-devel list if we write to external people to not annoy them ... ;-) -- Sebastian Mendel www.sebastianmendel.de

2 1

[Phpmyadmin-devel] MOPB-02-2007 deep recursion, phpMyAdmin affected?
by Sebastian Mendel 02 Mar '07

02 Mar '07

http://www.php-security.org/MOPB/MOPB-02-2007.html i did not fully 'understand' how we are affected, but i think we are affected somehow ... especially as i come to the sentence wehre phpMyAdmin is explicitely mentioned ... -- Sebastian Mendel www.sebastianmendel.de

3 15

[Phpmyadmin-devel] about bug #1615530 open_basedir with upload tmpdir outside
by Sebastian Mendel 02 Mar '07

02 Mar '07

https://sourceforge.net/support/tracker.php?aid=1615530 -- Sebastian Mendel www.sebastianmendel.de

1 0

[Phpmyadmin-devel] MOPB-03-2007 also
by Marc Delisle 01 Mar '07

01 Mar '07

Hi, I did not do much research but the bug MOPB-03-2007:PHP Variable Destructor Deep Recursion Stack Overflow is usable against phpMyAdmin, even with the latest patch. register_globals can be On of Off. Now continuing the analysis ... Marc

1 1

[Phpmyadmin-devel] MYSQLI_CLIENT_SSL
by Marc Delisle 01 Mar '07

01 Mar '07

Hi, I wonder if $cfg['Servers'][$i]['ssl'] = true; being true by default will not cause us some problems. https://sourceforge.net/forum/forum.php?thread_id=1683182&forum_id=72909 http://ca.php.net/mysqli MYSQLI_CLIENT_SSL Use SSL (encrypted protocol). This option should not be set by application programs; it is set internally in the MySQL client library. =========== "should not be set by application programs": this is us, no? :) They don't mention this warning for MYSQL_CLIENT_SSL. Marc

3 4

[Phpmyadmin-devel] phpMyAdmin 2.10.0.1 is released
by Marc Delisle 01 Mar '07

01 Mar '07

Hi, This version contains just one change from 2.10.0: a default value of false for $cfg['Servers'][$i]['ssl']. The default value of true is problematic on some servers. Details on http://www.phpmyadmin.net Marc Delisle, for the team

1 0

[Phpmyadmin-devel] phpMyAdmin 2.10.0 is released
by Marc Delisle 28 Feb '07

28 Feb '07

_ __ __ _ _ _ _ __ | |__ _ __ | \/ |_ _ / \ __| |_ __ ___ (_)_ __ | "_ \| "_ \| "_ \| |\/| | | | | / _ \ / _` | "_ ` _ \| | "_ \ | |_) | | | | |_) | | | | |_| |/ ___ \ (_| | | | | | | | | | | | .__/|_| |_| .__/|_| |_|\__, /_/ \_\__,_|_| |_| |_|_|_| |_| |_| |_| |___/ 2.10.0 http://www.phpmyadmin.net phpMyAdmin 2.10.0 - February 27, 2007 ===================================== A PHP application to administrate MySQL over the Web ---------------------------------------------------- Announcement ------------ The phpMyAdmin Project announces the immediate availability of phpMyAdmin 2.10.0. phpMyAdmin is a web administration tool for MySQL databases, intended to handle a whole database server as well as a single database. Over the years, it has become the most popular Web GUI for MySQL. Improvements: * Designer: new graphical relation manager * Improved speed on servers with thousands of databases/tables * Vertical field editor (optional) * Option to avoid counting rows for views * Calendar on search page * DOS-style end-of-lines in setup-generated files Detailed list of changes is usually available under http://www.phpmyadmin.net/ChangeLog.txt but at present time, please refer to the ChangeLog in the distribution kit for the most up to date information. Availability ------------ This software is available under the GNU General Public License V2.0. You can get the newest version at http://www.phpmyadmin.net/ Available file formats are: .zip, .tar.gz and .tar.bz2. If you install phpMyAdmin on your system, it's recommended to subscribe to the news mailing list by adding your address under http://lists.sourceforge.net/lists/listinfo/phpmyadmin-news This way, you will be informed of new updates and security fixes. It is a read only list, and traffic is not greater than a few mail every year. Support and Documentation ------------------------- The documentation is included in the software package as text and HTML file, but can also be downloaded from: http://www.phpmyadmin.net/documentation/ The software is provided as is without any express or implied warranty, but there is a bugs tracker page under: http://sourceforge.net/projects/phpmyadmin/ [click on "Bugs"] In addition, there are also a number of discussion lists related to phpMyAdmin. A list of mailing lists with archives is available at: http://sourceforge.net/mail/?group_id=23067 or http://sourceforge.net/projects/phpmyadmin/ [click on "Lists"] Finally, an users support forum is also available under: http://sourceforge.net/forum/forum.php?forum_id=72909 Known bugs ---------- Please subscribe to the news mailing list under http://lists.sourceforge.net/lists/listinfo/phpmyadmin-news or regularly check the sourceforge bugs tracker. Donations --------- The project accepts donations to help improve the product. There is a "Donations" link on http://www.phpmyadmin.net. Description ----------- (from http://www.phpmyadmin.net/documentation) phpMyAdmin handles the administration of MySQL over the Web. It can manage a whole MySQL server as well as a single database. Currently it can: * easily browse through databases and tables * create, copy, rename, alter and drop databases * create, copy, rename, alter and drop tables * do table maintenance * add, edit and drop fields * execute any SQL-statement, even multiple queries * create, alter and drop indexes * load text files into tables * create (*) and read dumps of tables or databases * export (*) data to SQL, CSV, XML, Word, Excel, PDF and Latex formats * administer multiple servers * manage MySQL users and privileges * check server settings and runtime information with configuration hints * check referential integrity in MyISAM tables * using Query-by-example (QBE), create complex queries automatically connecting required tables * create PDF graphics of your Database layout * search globally in a database or a subset of it * transform stored data into any format using a set of predefined functions, like displaying BLOB-data as image or download-link * support InnoDB tables and foreign keys (see FAQ 3.6) * support mysqli, the improved MySQL extension (see FAQ 1.17) * communicate in 50 different languages (*) phpMyAdmin can compress (Zip, GZip -RFC 1952- or Bzip2 formats) dumps and CSV exports if you use PHP4 >= 4.0.4 with Zlib support (--with-zlib) and/or Bzip2 support (--with-bz2). Authors & Copyright ------------------- Copyright (C) 1998-2000 Tobias Ratschiller <tobias_at_ratschiller.com> Copyright (C) 2001-2007 Marc Delisle <Marc.Delisle_at_cegepsherbrooke.qc.ca> Olivier Müller <om_at_omnis.ch> Robin Johnson <robbat2_at_users.sourceforge.net> Alexander M. Turek <me_at_derrabus.de> Michal Cihar <michal_at_cihar.com> Garvin Hicking <me_at_supergarv.de> Sebastian Mendel <cybot_tm_at_users.sourceforge.net> + many other people (check the CREDITS section of our documentation) This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA Marc Delisle / 2007-02-27

1 0