CVE-2016-6630: Input Validation

Published Dec 11, 2016

Updated

An issue was discovered in phpMyAdmin. An authenticated user can trigger a denial-of-service (DoS) attack by entering a very long password at the change password dialog. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

Affected Software

60 affected components

phpMyAdmin phpMyAdmin=4.6.0

phpMyAdmin phpMyAdmin=4.6.1

phpMyAdmin phpMyAdmin=4.6.2

phpMyAdmin phpMyAdmin=4.6.3

phpMyAdmin phpMyAdmin=4.4.0

phpMyAdmin phpMyAdmin=4.4.1

phpMyAdmin phpMyAdmin=4.4.1.1

phpMyAdmin phpMyAdmin=4.4.2

phpMyAdmin phpMyAdmin=4.4.3

phpMyAdmin phpMyAdmin=4.4.4

phpMyAdmin phpMyAdmin=4.4.5

phpMyAdmin phpMyAdmin=4.4.6

phpMyAdmin phpMyAdmin=4.4.6.1

phpMyAdmin phpMyAdmin=4.4.7

phpMyAdmin phpMyAdmin=4.4.8

phpMyAdmin phpMyAdmin=4.4.9

phpMyAdmin phpMyAdmin=4.4.10

phpMyAdmin phpMyAdmin=4.4.11

phpMyAdmin phpMyAdmin=4.4.12

phpMyAdmin phpMyAdmin=4.4.13

phpMyAdmin phpMyAdmin=4.4.13.1

phpMyAdmin phpMyAdmin=4.4.14

phpMyAdmin phpMyAdmin=4.4.14.1

phpMyAdmin phpMyAdmin=4.4.15

phpMyAdmin phpMyAdmin=4.4.15.1

phpMyAdmin phpMyAdmin=4.4.15.2

phpMyAdmin phpMyAdmin=4.4.15.3

phpMyAdmin phpMyAdmin=4.4.15.4

phpMyAdmin phpMyAdmin=4.4.15.5

phpMyAdmin phpMyAdmin=4.4.15.6

phpMyAdmin phpMyAdmin=4.4.15.7

phpMyAdmin phpMyAdmin=4.0.0

phpMyAdmin phpMyAdmin=4.0.1

phpMyAdmin phpMyAdmin=4.0.2

phpMyAdmin phpMyAdmin=4.0.3

phpMyAdmin phpMyAdmin=4.0.4

phpMyAdmin phpMyAdmin=4.0.4.1

phpMyAdmin phpMyAdmin=4.0.4.2

phpMyAdmin phpMyAdmin=4.0.5

phpMyAdmin phpMyAdmin=4.0.6

phpMyAdmin phpMyAdmin=4.0.7

phpMyAdmin phpMyAdmin=4.0.8

phpMyAdmin phpMyAdmin=4.0.9

phpMyAdmin phpMyAdmin=4.0.10

phpMyAdmin phpMyAdmin=4.0.10.1

phpMyAdmin phpMyAdmin=4.0.10.2

phpMyAdmin phpMyAdmin=4.0.10.3

phpMyAdmin phpMyAdmin=4.0.10.4

phpMyAdmin phpMyAdmin=4.0.10.5

phpMyAdmin phpMyAdmin=4.0.10.6

phpMyAdmin phpMyAdmin=4.0.10.7

phpMyAdmin phpMyAdmin=4.0.10.8

phpMyAdmin phpMyAdmin=4.0.10.9

phpMyAdmin phpMyAdmin=4.0.10.10

phpMyAdmin phpMyAdmin=4.0.10.11

phpMyAdmin phpMyAdmin=4.0.10.12

phpMyAdmin phpMyAdmin=4.0.10.13

phpMyAdmin phpMyAdmin=4.0.10.14

phpMyAdmin phpMyAdmin=4.0.10.15

phpMyAdmin phpMyAdmin=4.0.10.16

Remediation

Patch Available

https://www.phpmyadmin.net/security/PMASA-2016-53

Event History

Dec 11, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-6630?

CVE-2016-6630 is classified as a denial-of-service (DoS) vulnerability.

How do I fix CVE-2016-6630?

To mitigate CVE-2016-6630, update phpMyAdmin to version 4.6.4 or later, 4.4.15.8 or later, or 4.0.10.17 or later.

Which versions are affected by CVE-2016-6630?

CVE-2016-6630 affects all versions of phpMyAdmin prior to 4.6.4, 4.4.15.8, and 4.0.10.17.

Can an attacker exploit CVE-2016-6630 remotely?

CVE-2016-6630 requires authenticated access, so an attacker must be a registered user to exploit it.

What impact does CVE-2016-6630 have on phpMyAdmin?

CVE-2016-6630 allows attackers to trigger a denial-of-service by submitting overly long passwords during the password change process.