From dedd542cdaf1606ca9aa3f6f8f8adb078d8ad549 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 16 Apr 2013 15:15:05 +0200 Subject: [PATCH 1/6] Dropped unsafe usage of preg_replace It could be tricked by apending /e\x00 to execute arbitrary php code. The new code does simple string replace, we don't really need any of regex stuff here. --- libraries/mult_submits.inc.php | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/libraries/mult_submits.inc.php b/libraries/mult_submits.inc.php index 30654922eb..1eafb96c3d 100644 --- a/libraries/mult_submits.inc.php +++ b/libraries/mult_submits.inc.php @@ -425,14 +425,23 @@ if (!empty($submit_mult) && !empty($what)) { case 'replace_prefix_tbl': $current = $selected[$i]; - $newtablename = preg_replace("/^" . $from_prefix . "/", $to_prefix, $current); + if (substr($current, 0, strlen($from_prefix)) == $from_prefix) { + $newtablename = $to_prefix . substr($current, strlen($from_prefix)); + } else { + $newtablename = $current; + } $a_query = 'ALTER TABLE ' . PMA_backquote($selected[$i]) . ' RENAME ' . PMA_backquote($newtablename) ; // CHANGE PREFIX PATTERN $run_parts = true; break; case 'copy_tbl_change_prefix': $current = $selected[$i]; - $newtablename = preg_replace("/^" . $from_prefix . "/", $to_prefix, $current); + if (substr($current, 0, strlen($from_prefix)) == $from_prefix) { + $newtablename = $to_prefix . substr($current, strlen($from_prefix)); + } else { + $newtablename = $current; + } + $newtablename = $to_prefix . substr($current, strlen($from_prefix)); $a_query = 'CREATE TABLE ' . PMA_backquote($newtablename) . ' SELECT * FROM ' . PMA_backquote($selected[$i]) ; // COPY TABLE AND CHANGE PREFIX PATTERN $run_parts = true; break; From ffa720d90a79c1f33cf4c5a33403d09a67b42a66 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Thu, 18 Apr 2013 05:53:58 -0400 Subject: [PATCH 2/6] Prevent null-byte injection in preg_replace() --- libraries/Tracker.class.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libraries/Tracker.class.php b/libraries/Tracker.class.php index 2f50623832..3d27f896a8 100644 --- a/libraries/Tracker.class.php +++ b/libraries/Tracker.class.php @@ -877,6 +877,9 @@ class PMA_Tracker if (empty($dbname)) { return; } + // Remove null bytes (preg_replace() is vulnerable in some + // PHP versions) + $dbname = str_replace("\0", "", $dbname); // If we found a valid statement if (isset($result['identifier'])) { From d3fafdfba0807068196655e9b6d16c5d1d3ccf8a Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Sat, 20 Apr 2013 07:07:29 -0400 Subject: [PATCH 3/6] Security: remove dots in template to avoid a remote code execution vulnerability --- export.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/export.php b/export.php index 7036af9277..10567d1d1a 100644 --- a/export.php +++ b/export.php @@ -272,6 +272,8 @@ if ($asfile) { 'Export/file_template_table', $filename_template); } } + // remove dots in template to avoid a remote code execution vulnerability + $filename_template = str_replace('.', '', $filename_template); $filename = PMA_expandUserString($filename_template); $filename = PMA_sanitize_filename($filename); From 1f6bc0b707002e26cab216b9e57b4d5de764de48 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Sun, 21 Apr 2013 06:41:02 -0400 Subject: [PATCH 4/6] Security: block another case of remote execution vulnerability --- export.php | 6 +++--- libraries/sanitizing.lib.php | 19 +++++++++++++++---- 2 files changed, 18 insertions(+), 7 deletions(-) diff --git a/export.php b/export.php index 10567d1d1a..6084cafc5f 100644 --- a/export.php +++ b/export.php @@ -272,10 +272,10 @@ if ($asfile) { 'Export/file_template_table', $filename_template); } } - // remove dots in template to avoid a remote code execution vulnerability - $filename_template = str_replace('.', '', $filename_template); $filename = PMA_expandUserString($filename_template); - $filename = PMA_sanitize_filename($filename); + // remove dots in filename (coming from either the template or already + // part of the filename) to avoid a remote code execution vulnerability + $filename = PMA_sanitize_filename($filename, $replaceDots = true); // Grab basic dump extension and mime type // Check if the user already added extension; get the substring where the extension would be if it was included diff --git a/libraries/sanitizing.lib.php b/libraries/sanitizing.lib.php index 1f3110f305..111fdf3859 100644 --- a/libraries/sanitizing.lib.php +++ b/libraries/sanitizing.lib.php @@ -134,18 +134,29 @@ function PMA_sanitize($message, $escape = false, $safe = false) /** - * Sanitize a filename by removing anything besides A-Za-z0-9_.- + * Sanitize a filename by removing anything besides legit characters * * Intended usecase: - * When using a filename in a Content-Disposition header the value should not contain ; or " + * When using a filename in a Content-Disposition header the value + * should not contain ; or " + * + * When exporting, avoiding generation of an unexpected double-extension file * * @param string The filename + * @param boolean Whether to also replace dots * * @return string the sanitized filename * */ -function PMA_sanitize_filename($filename) { - $filename = preg_replace('/[^A-Za-z0-9_.-]/', '_', $filename); +function PMA_sanitize_filename($filename, $replaceDots = false) { + $pattern = '/[^A-Za-z0-9_'; + // if we don't have to replace dots + if (! $replaceDots) { + // then add the dot to the list of legit characters + $pattern .= '.'; + } + $pattern .= '-]/'; + $filename = preg_replace($pattern, '_', $filename); return $filename; } From be9ec6d00843c3a94436333cee4fcc8ad1182c68 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Wed, 24 Apr 2013 08:15:36 -0400 Subject: [PATCH 5/6] ChangeLog entries for security fixes --- ChangeLog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ChangeLog b/ChangeLog index 3f3e8511cb..865b78bc51 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,12 @@ phpMyAdmin - ChangeLog ====================== +3.5.8.1 (2013-04-24) +- [security] Remote code execution (preg_replace), reported by Janek Vind + (see PMASA-2013-2) +- [security] Locally Saved SQL Dump File Multiple File Extension Remote Code + Execution, reported by Janek Vind (see PMASA-2013-3) + 3.5.8.0 (2013-04-08) - bug #3828 MariaDB reported as MySQL - bug #3854 Incorrect header for Safari 6.0 From ddada9fb95990527888e051b656fcd988467fde2 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Wed, 24 Apr 2013 08:17:50 -0400 Subject: [PATCH 6/6] 3.5.8.1 release --- Documentation.html | 4 ++-- README | 2 +- libraries/Config.class.php | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Documentation.html b/Documentation.html index 4ad73f2c9f..965d21f883 100644 --- a/Documentation.html +++ b/Documentation.html @@ -8,7 +8,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 - phpMyAdmin 3.5.8 - Documentation + phpMyAdmin 3.5.8.1 - Documentation @@ -16,7 +16,7 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78 diff --git a/README b/README index ff9a5f59b3..b385d073ab 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ phpMyAdmin - Readme =================== -Version 3.5.8 +Version 3.5.8.1 A set of PHP-scripts to manage MySQL over the web. diff --git a/libraries/Config.class.php b/libraries/Config.class.php index 3db7ee6eec..42ec5504a1 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -98,7 +98,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '3.5.8'); + $this->set('PMA_VERSION', '3.5.8.1'); /** * @deprecated */