Resource management error in phpMyAdmin - CVE-2014-9218
Published: December 8, 2014 / Updated: August 9, 2020
Vulnerability identifier: #VU41031
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-9218
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service (resource consumption) via a long password.
Affected software
phpMyAdmin
Fedora
phpMyAdmin
phpMyAdmin4
Fedora
phpMyAdmin
phpMyAdmin4
How to mitigate CVE-2014-9218
Install update from vendor's website.
phpMyAdmin - addressed in versions 4.0.10.7-1.el6, 4.2.13.1-1.el7, 4.2.13.1-1.fc21
phpMyAdmin4 - update to 4.0.10.7-2.el5
phpMyAdmin4 - update to 4.0.10.7-2.el5
Links to Public Exploits and PoC-codes
External References
- http://www.debian.org/security/2015/dsa-3382
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:243
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php
- http://www.securityfocus.com/bid/71434
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99140
- https://github.com/phpmyadmin/phpmyadmin/commit/095729d81205f15f40d216d25917017da4c2fff8
- https://github.com/phpmyadmin/phpmyadmin/commit/1ac863c7573d12012374d5d41e5c7dc5505ea6e1
- https://github.com/phpmyadmin/phpmyadmin/commit/62b2c918d26cc78d1763945e3d44d1a63294a819