Executive Summary
Informations | |||
---|---|---|---|
Name | CVE-2016-6606 | First vendor Publication | 2016-12-10 |
Vendor | Cve | Last vendor Modification | 2017-07-01 |
Security-Database Scoring CVSS v3
Cvss vector : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | |||
---|---|---|---|
Overall CVSS Score | 8.1 | ||
Base Score | 8.1 | Environmental Score | 8.1 |
impact SubScore | 5.9 | Temporal Score | 8.1 |
Exploitabality Sub Score | 2.2 | ||
Attack Vector | Network | Attack Complexity | High |
Privileges Required | None | User Interaction | None |
Scope | Unchanged | Confidentiality Impact | High |
Integrity Impact | High | Availability Impact | High |
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |||
---|---|---|---|
Cvss Base Score | 5 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Furthermore, the same initialization vector (IV) is used to hash the username and password stored in the phpMyAdmin cookie. If a user has the same password as their username, an attacker who examines the browser cookie can see that they are the same - but the attacker can not directly decode these values from the cookie as it is still hashed. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. |
Original Source
Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6606 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
50 % | CWE-310 | Cryptographic Issues |
50 % | CWE-200 | Information Exposure |
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2017-01-12 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201701-32.nasl - Type : ACT_GATHER_INFO |
2016-11-21 | Name : The remote web server hosts a PHP application that is affected by multiple vu... File : phpmyadmin_pmasa_2016_29.nasl - Type : ACT_GATHER_INFO |
2016-09-19 | Name : The remote Debian host is missing a security update. File : debian_DLA-626.nasl - Type : ACT_GATHER_INFO |
2016-08-30 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1021.nasl - Type : ACT_GATHER_INFO |
2016-08-30 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1027.nasl - Type : ACT_GATHER_INFO |
2016-08-18 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_ef70b201645d11e69cdc6805ca0b3d42.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
Date | Informations |
---|---|
2024-02-02 01:40:47 |
|
2024-02-01 12:11:35 |
|
2023-09-05 12:38:54 |
|
2023-09-05 01:11:20 |
|
2023-09-02 12:38:41 |
|
2023-09-02 01:11:35 |
|
2023-08-12 12:42:03 |
|
2023-08-12 01:11:04 |
|
2023-08-11 12:36:53 |
|
2023-08-11 01:11:22 |
|
2023-08-06 12:35:39 |
|
2023-08-06 01:11:03 |
|
2023-08-04 12:35:48 |
|
2023-08-04 01:11:07 |
|
2023-07-14 12:35:50 |
|
2023-07-14 01:11:06 |
|
2023-03-29 01:37:36 |
|
2023-03-28 12:11:26 |
|
2021-05-04 12:52:44 |
|
2021-04-22 02:04:57 |
|
2020-05-23 00:52:43 |
|
2019-06-19 12:08:00 |
|
2017-07-01 09:23:43 |
|
2017-01-13 13:24:47 |
|
2016-12-13 21:25:22 |
|
2016-12-13 09:24:56 |
|
2016-12-11 09:36:32 |
|