[ GLSA 201707-03 ] phpMyAdmin

[GLSA]

Gentoo Linux Security Advisory

Title: phpMyAdmin: Security bypass (GLSA 201707-03)
Severity: normal
Exploitable: remote
Date: 2017-07-08
Updated: 2017-08-06
Bug(s): #614522
ID: 201707-03

Synopsis

A vulnerability in phpMyAdmin might allow remote attackers to
bypass authentication.


Background

phpMyAdmin is a web-based management tool for MySQL databases.

Affected Packages

Package: dev-db/phpmyadmin
Vulnerable: < 4.0.10.20
Vulnerable: < 4.7.0
Unaffected: >= 4.0.10.20
Unaffected: >= 4.7.0
Architectures: All supported architectures


Description

A vulnerability was discovered where the restrictions caused by
“$cfg[‘Servers’][$i][‘AllowNoPassword’] = false” are bypassed
under certain PHP versions. This can lead compromised user accounts, who
have no passwords set, even if the administrator has set
“$cfg[‘Servers’][$i][‘AllowNoPassword’]” to false (which is
the default).
This behavior depends on the PHP version used (it seems PHP 5 is
affected, while PHP 7.0 is not).


Impact

A remote attacker, who only needs to know the username, could bypass
security restrictions and access phpMyAdmin.


Workaround

Set a password for all users.

Resolution

All phpMyAdmin 4.0.x users should upgrade to the latest version: