[Full-disclosure] Vulnerabilities in phpMyAdmin

["MustLive" <mustlive@xxxxxxxxxxxxxxxxxx>]

Hello list!

I want to warn you about Brute Force and Full path disclosure
vulnerabilities in phpMyAdmin.

CVE id: CVE-2011-0986.

WASC ids: WASC-11, WASC-13.

CWE ids: CWE-661, CWE-200.

-------------------------
Affected products:
-------------------------

Vulnerable are phpMyAdmin 3.3.9 and previous versions and phpMyAdmin
2.11.11.1 and previous versions. All applications (such as XAMPP), which are
using phpMyAdmin, are also vulnerable.

Full path disclosure vulnerabilities were fixed by developers in versions
3.3.9.1 and 2.11.11.2.

----------
Details:
----------

Brute Force (WASC-11):

http://site/phpmyadmin/

In login form there is no protection from Brute Force attacks.

Full path disclosure (WASC-13):

http://site/phpmyadmin/readme.php (if there is no README file in folder 
phpmyadmin)

http://site/phpmyadmin/changelog.php (if there is no ChangeLog file in 
folder phpmyadmin)

http://site/phpmyadmin/license.php (if there is no LICENSE file in folder 
phpmyadmin)

------------
Timeline:
------------

2011.01.25 - announced at my site.
2011.01.26 - informed developers.
2011.01.31 - received answer from developers.
2011-02-01 - I gave developers additional argumentations and recommendations
about fixing Brute Force and Full path disclosure holes and privately
informed about all those Fingerprinting (WASC-45) holes in phpMyAdmin.
2011-02-08 - developers fixed FPD holes
(http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php).
2011.02.28 - disclosed at my site.

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/4872/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/