<em style='font-weight:bold;'>(Description Provided by <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2011-2507" target="_blank">CVE</a>)</em> : libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and consequently execute arbitrary PHP code, by leveraging the ability to modify the SESSION superglobal array.

Upgrade to version 3.3.10.2 or 3.4.3.1 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2011-2507 (see also: NVD)
• Secunia Advisory ID: 45128 45139 45292 45315 47385
• Related OSVDB ID: 73611 73612 73614
• Other Advisory URL: http://0x6a616d6573.blogspot.com/2011/07/phpmyadmin-fud.html
  http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html
  http://ha.xxor.se/2011/07/phpmyadmin-3x-pregreplace-rce-poc.html
  http://www.openwall.com/lists/oss-security/2011/06/28/2
  http://www.openwall.com/lists/oss-security/2011/06/28/6
  http://www.openwall.com/lists/oss-security/2011/06/28/8
  http://www.openwall.com/lists/oss-security/2011/06/29/11
  http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt
• Vendor Specific Advisory URL: http://lists.debian.org/debian-security-announce/2011/msg00160.html
  http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/
  http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php
• Vendor Specific News/Changelog Entry: http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html
  http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=69fb0f8e7dc38075427aceaf09bcac697d0590ff
  http://www.gentoo.org/security/en/glsa/glsa-201201-01.xml
• Mail List Post: http://www.securityfocus.com/archive/1/archive/1/518804/100/0/threaded

• Frans Pehrson - Xxor AB