CVE-2009-0919: High severity Apachefriends Xampp vulnerability
XAMPP installs multiple packages with insecure default passwords, which makes it easier for remote attackers to obtain access via (1) the "lampp" default password for the "nobody" account within the included ProFTPD installation, (2) a blank default password for the "root" account within the included MySQL installation, (3) a blank default password for the "pma" account within the phpMyAdmin installation, and possibly other unspecified passwords. NOTE: this was originally reported as a problem in DFLabs PTK, but this issue affects any product that is installed within the XAMPP environment, and should not be viewed as a vulnerability within that product. NOTE: DFLabs states that PTK is intended for use in a laboratory with "no contact from / to internet."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set a non-default, strong password for the 'nobody' account used by the bundled ProFTPD; replace the default 'lampp' password immediately.
ProFTPD (included in XAMPP) password for 'nobody' account = change from 'lampp' to a strong unique password (not 'lampp') - Configuration
Configure a non-empty, strong password for the MySQL 'root' account to replace the blank default.
MySQL (included in XAMPP) root account password = set a non-empty strong password (not blank) - Configuration
Set a non-empty, strong password for the 'pma' account used by phpMyAdmin to replace the blank default.
phpMyAdmin (included in XAMPP) pma account password = set a non-empty strong password (not blank) - Configuration
Audit all services and applications installed within the XAMPP environment for default or blank credentials and change each to a unique strong password.
XAMPP-installed components default/blank passwords = replace any default or blank passwords with strong, unique passwords - Compensating control
Use XAMPP only in an isolated laboratory environment with no contact from/to the internet; restrict inbound and outbound network access to XAMPP hosts via firewall rules or network segmentation so services are only reachable from trusted lab networks.
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0919?
CVE-2009-0919 has a medium severity level due to the use of insecure default passwords in XAMPP installations.
How do I fix CVE-2009-0919?
To fix CVE-2009-0919, change the default passwords for the 'nobody' and 'root' accounts in XAMPP.
What versions of XAMPP are affected by CVE-2009-0919?
CVE-2009-0919 affects multiple versions of XAMPP, including 1.4.3, 1.4.9, 1.5.0, 1.5.2, and several others.
Can CVE-2009-0919 be exploited remotely?
Yes, CVE-2009-0919 can be exploited remotely due to the insecure default passwords on XAMPP installations.
What should I do if I am using an affected version of XAMPP?
If using an affected version of XAMPP, you should update to a secure version and change any insecure default passwords.