IPv6 and proxy server IP-based authentication rule circumvention

PMASA-2016-47

Announcement-ID: PMASA-2016-47

Date: 2016-07-21

Summary

IPv6 and proxy server IP-based authentication rule circumvention

Description

A vulnerability was discovered where, under certain circumstances, it may be possible to circumvent the phpMyAdmin IP-based authentication rules.

When phpMyAdmin is used with IPv6 in a proxy server environment, and the proxy server is in the allowed range but the attacking computer is not allowed, this vulnerability can allow the attacking computer to connect despite the IP rules.

Severity

We consider this vulnerability to be serious

Mitigation factor

• The phpMyAdmin installation must be running with IP-based allow/deny rules * The phpMyAdmin installation must be running behind a proxy server (or proxy servers) where the proxy server is “allowed” and the attacker is “denied” * The connection between the proxy server and phpMyAdmin must be via IPv6

Affected Versions

All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected

Solution

Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, or 4.0.10.17 or newer or apply patch listed below.

References

Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability.

Assigned CVE ids: CVE-2016-6624

CWE ids: CWE-661

Patches

The following commits have been made on the 4.0 branch to fix this issue:

• 4440790

The following commits have been made on the 4.4 branch to fix this issue:

• e291300

The following commits have been made on the 4.6 branch to fix this issue:

• 6aacd7d

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.