oss-security - Re: CVE for Wordpress plugin Portable-phpmyadmin

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 21 Oct 2013 23:46:07 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Ciprian Popescu <ciprian@...butterfly.com>, plugins@...dpress.org
Subject: Re: CVE for Wordpress plugin Portable-phpmyadmin

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/21/2013 08:45 PM, Anant Shrivastava wrote:
> Old download URL http://wordpress.org/plugins/portable-phpmyadmin/ 
> As already informed the download link will not work as it is
> disabled by word press plugin team
> 
> Svn repository
> http://plugins.svn.wordpress.org/portable-phpmyadmin/
> 
> Effected version 1.4.1
> 
> -Anant

Thanks, please use CVE-2013-4454 for this issue.

> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
> 
> On 10/21/2013 09:08 AM, Anant Shrivastava wrote:
>> Hi Team,
>> 
>> Please issue CVE for following issues identified in a wordpress 
>> plugin portable-phpmyadmin
>> 
>> 
>> *PHP information Disclosure * /pma/phpinfo.php
>> 
>> *Security Bypass * Allows direct access (with each file level of 
>> access differs but you get DB access with wordpress database 
>> username and password) /pma/db_create.php /pma/main.php -
>> reveals all the details of database stuff. /pma/db_datadict.php 
>> /pma/import.php /pma/querywindow.php /pma/server_databases.php - 
>> Full access to all features including SQL window 
>> /pma/server_export.php
>> 
>> 
>> *Disclosure Status. * Author (marked in CC) as well as Wordpress 
>> Plugin team (marked in CC) is aware of the issues. Wordpress
>> plugin team has disabled the plugin download till issues are
>> resolved. Author initially responded but stopped responding after
>> a point.
>> 
>> *Timeline* First contact : 24 July 2013 Last response from Author
>> : 9 Aug 2013 Wordpress plugin team contacted : 11 Sep 2013
>> Plugin Disabled in plugin repository : 15 Sep 2013 CVE Requested
>> : 21 Oct 2013
>> 
>> 
>> -Anant Shrivastava
>> 
> 
> Can you post the url/download link for this app?
> 
> - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP:
> 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 
> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux)
> 
> iQIcBAEBAgAGBQJSZYssAAoJEBYNRVNeJnmTPJgQANtKvnRl4scnR98T1mye1qwB 
> 14IqpjNgQhYnhajrEUK+heJhudbIN4CS4Mwu01mVIoUdj2GKBP0iRgdc9vBJCDSY 
> FbVfGjshuQvCKMDd1KGRcKPJG0fxnDk+CKk0HDP/pwgyot6toSeP37WYdEgZH70g 
> XwWXR//OT0/B7n77EB9jQT/izFBhuea4tTN1mtLHjfQMLCOdLsbF2umTp6A7eg9K 
> u44ENGbO5sVekDMvUE1QwnKH7LnsKzbQXp7ZYreEVyPBB3FMqcmg5Yob38JKDWmb 
> /1lSOA3C9NS4SIxXwkNkDHcg/vK2kOWDeGO8/hde/JOnv8tBlUHpTSKC1hF6gv7F 
> WS66n0dfhKgIHBOma4vU5sXtUdys1wKnjqwgyyWNfKgaoiHrtS66ngVDOkzdBTCX 
> 7Mp1KHm9zFN9zJbugY9un7EoE1ftTbDC2LUbDbz5sg9Sc4delsuzH302emvM6YcD 
> pIM2ppf6+Q2VLpvCF44TjymU/5p8x+JsqoxVQmqqREcpniKs59ZAhBWcjSfDXRl1 
> oyNOKpny3uqVoPvgTsX07UUdW5ZW9x/UQWXWSaYWXYXGS/Ul0sCy6eTHjL6RzZAa 
> OjuzUvMpOjVzuPN2i7hbCWSBhfKv8fzmUtWCCgSoaTNeugDIFrNKBPVauP0cczZQ 
> iO/91DCwjvyxb0aNX5yg =YBh8 -----END PGP SIGNATURE-----
> 


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)

iQIcBAEBAgAGBQJSZhEfAAoJEBYNRVNeJnmTLYoQAIkwD3+V8iZ4sakOP2crVHDJ
+fWEsRJr+AuAypYI23BrLP11tvPiYiDQgudx4GjSwF7Bm63YFVEHiD14FpaywvMC
sq/DFZ8m/5W44YqLk4/sv17kRHyjHqUlccYsl/QEga9Cupz8kc3oe/RzvhmN2NYH
UUccsonfpdhfRgRqWyOlXccNrNNUObsIupHBNHPt163EzihBRq4Cnhe1PGvryPih
o+N55gtuLT1+yvNHDJ+nlt04VGlKGleQcg6IvIFQvEZTj9IuLZyhQFktbTx77uOZ
WRMGjQxtxlydwVdLPXld/3X9GNjkd22YHuC+T9K2fUFDCxKgNBq99J15JweTEJ5B
UjHD+id8OYs0DWFSJ4HmVIi6xf4F/si9zAB24Dy/iNmhQtcjXjE+uFZQrxq6yfYX
RS/dKpXUtl6OztKVCb5uxIUSW2mWfveauFklgEL6+PiLG6/YihN8q9JZb1lNReh3
ackL9OMWcOSCmlXIn2d4nCBbEPrDIrGdMayGImXJf0isK/pk8eflOk4u3aD4ZTbR
dChwNO+apqqhNCq6JkWOI7kJy3sn8qxd382gB7F0iGng6XbkEqY1xT8v+eoFBRaL
SsnUEiqKmzM1E88EfMmbdVKL8h4PiQnuYRcoDqy74Bo2Y6C8muDNvulonWs6GAd3
Z6jDnb4J+WQgj7eTc/Pd
=KB5p
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.