Can't login to phpmyadmin (possibly related to a phpMyAdmin vulnerability)

Hi,

For some reason my server crashed. When I brought it back up I found no real problems or inconsistencies, but when tried to visit phpmyadmin I get:

1045 - Access denied for user 'root'@'localhost' (using password: NO)
Invalid hostname for server 1. Please review your configuration.

Any way to solve this?

 

By the way, this shows everytime, i can't even try to login, it happens as soon as i open phpmyadmin.

 

I have exactly the same problem.

It appeared out of nowhere, maybe after I did an update.

I tried what you suggested, but it seems clear that this is a server problem.

 

No workieworkie - workaround provided

exactly, manarak!

Anyway, what I did as a workaround was:

1. Edit /var/lib/phpmyadmin/config.inc.php;
2. Change the option value 'config' to 'cookie'.

I'm still getting the error "Invalid hostname for server 1. Please review your configuration." but at least I can login again.

 

cool, thanks - it would still be interesting to find out what broke phpmyadmin though.

 

ok, it looks like the config file was changed, the hostname is commented out and there is a phpinfo(); in its place.

that could be an injection attack ?

is there a known vulnerability?

 

yes there is:

http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/

we have been injected !!

 

my server has always been updated less than 12 hours after new versions were out.

it is just frightening!!

two weeks ago I have been infected with very nasty troyans on the PC inspite of an up-to-date antivirus.

then there are those nasty hidden iframe viruses out...


the internet has become VERY DANGEROUS in the last months!

 

if I chmod the config file to 440, that should stop the attack, no?

 

could you please change the thread topic and add [phpMyAdmin vulnerability] in front of it?

 

the probability that he has been injected like me is 99%

the injection does modify the hostname entry in the config file, and his problem appeared out of nowhere in the last days...
Now how big a coincidence is that??

 

Same issue here. Debian Lenny, last updates. Config file has been modified! Looks serious!!!

 

read the description of the vulnerability: "arbitrary code execution"
need I say more?