CVE-2016-9850: Medium severity phpmyadmin vulnerability

Published Dec 11, 2016

Updated

An issue was discovered in phpMyAdmin. Username matching for the allow/deny rules may result in wrong matches and detection of the username in the rule due to non-constant execution time. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

Affected Software

63 affected components

phpMyAdmin phpMyAdmin=4.6.0

phpMyAdmin phpMyAdmin=4.6.1

phpMyAdmin phpMyAdmin=4.6.2

phpMyAdmin phpMyAdmin=4.6.3

phpMyAdmin phpMyAdmin=4.6.4

phpMyAdmin phpMyAdmin=4.4.0

phpMyAdmin phpMyAdmin=4.4.1

phpMyAdmin phpMyAdmin=4.4.1.1

phpMyAdmin phpMyAdmin=4.4.2

phpMyAdmin phpMyAdmin=4.4.3

phpMyAdmin phpMyAdmin=4.4.4

phpMyAdmin phpMyAdmin=4.4.5

phpMyAdmin phpMyAdmin=4.4.6

phpMyAdmin phpMyAdmin=4.4.6.1

phpMyAdmin phpMyAdmin=4.4.7

phpMyAdmin phpMyAdmin=4.4.8

phpMyAdmin phpMyAdmin=4.4.9

phpMyAdmin phpMyAdmin=4.4.10

phpMyAdmin phpMyAdmin=4.4.11

phpMyAdmin phpMyAdmin=4.4.12

phpMyAdmin phpMyAdmin=4.4.13

phpMyAdmin phpMyAdmin=4.4.13.1

phpMyAdmin phpMyAdmin=4.4.14

phpMyAdmin phpMyAdmin=4.4.14.1

phpMyAdmin phpMyAdmin=4.4.15

phpMyAdmin phpMyAdmin=4.4.15.1

phpMyAdmin phpMyAdmin=4.4.15.2

phpMyAdmin phpMyAdmin=4.4.15.3

phpMyAdmin phpMyAdmin=4.4.15.4

phpMyAdmin phpMyAdmin=4.4.15.5

phpMyAdmin phpMyAdmin=4.4.15.6

phpMyAdmin phpMyAdmin=4.4.15.7

phpMyAdmin phpMyAdmin=4.4.15.8

phpMyAdmin phpMyAdmin=4.0.0

phpMyAdmin phpMyAdmin=4.0.1

phpMyAdmin phpMyAdmin=4.0.2

phpMyAdmin phpMyAdmin=4.0.3

phpMyAdmin phpMyAdmin=4.0.4

phpMyAdmin phpMyAdmin=4.0.4.1

phpMyAdmin phpMyAdmin=4.0.4.2

phpMyAdmin phpMyAdmin=4.0.5

phpMyAdmin phpMyAdmin=4.0.6

phpMyAdmin phpMyAdmin=4.0.7

phpMyAdmin phpMyAdmin=4.0.8

phpMyAdmin phpMyAdmin=4.0.9

phpMyAdmin phpMyAdmin=4.0.10

phpMyAdmin phpMyAdmin=4.0.10.1

phpMyAdmin phpMyAdmin=4.0.10.2

phpMyAdmin phpMyAdmin=4.0.10.3

phpMyAdmin phpMyAdmin=4.0.10.4

phpMyAdmin phpMyAdmin=4.0.10.5

phpMyAdmin phpMyAdmin=4.0.10.6

phpMyAdmin phpMyAdmin=4.0.10.7

phpMyAdmin phpMyAdmin=4.0.10.8

phpMyAdmin phpMyAdmin=4.0.10.9

phpMyAdmin phpMyAdmin=4.0.10.10

phpMyAdmin phpMyAdmin=4.0.10.11

phpMyAdmin phpMyAdmin=4.0.10.12

phpMyAdmin phpMyAdmin=4.0.10.13

phpMyAdmin phpMyAdmin=4.0.10.14

phpMyAdmin phpMyAdmin=4.0.10.15

phpMyAdmin phpMyAdmin=4.0.10.16

phpMyAdmin phpMyAdmin=4.0.10.17

Remediation

Patch Available

https://www.phpmyadmin.net/security/PMASA-2016-61

Event History

Dec 11, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-9850?

CVE-2016-9850 is considered to have a moderate severity level due to the potential for username matching issues in phpMyAdmin.

How do I fix CVE-2016-9850?

To fix CVE-2016-9850, upgrade to phpMyAdmin version 4.6.5 or later for 4.6.x, 4.4.15.9 or later for 4.4.x, and 4.0.10.18 or later for 4.0.x.

Which versions of phpMyAdmin are affected by CVE-2016-9850?

CVE-2016-9850 affects phpMyAdmin versions 4.6.0 to 4.6.4, 4.4.0 to 4.4.15.8, and 4.0.0 to 4.0.10.17.

What kind of vulnerability is CVE-2016-9850?

CVE-2016-9850 is a vulnerability related to improper username matching which can lead to unauthorized access or manipulation.

Is there a workaround for CVE-2016-9850?

There is no official workaround for CVE-2016-9850; the recommended solution is to upgrade to the patched versions.