CVE-2014-9218: Resource Management Errors (CWE-399)
value: libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service (resource consumption) via a long password.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2014-12-08T11:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: ChangeLog, libraries/common.inc.php, libraries/plugins/AuthenticationPlugin.class.php, libraries/plugins/auth/AuthenticationCookie.class.php
Commit date: 2014-12-02 21:20:59 +0530
Commit message: bug #4611 [security] DOS attack with long passwords

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>

Diff: diff --git a/ChangeLog b/ChangeLog
index 77219f578671..c78b40a24f21 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,10 +1,11 @@
 phpMyAdmin - ChangeLog
 ======================
 
 4.2.13.1 (not yet released)
 - bug #4612 [security] XSS vulnerability in redirection mechanism
+- bug #4611 [security] DOS attack with long passwords
 
 4.2.13.0 (2014-11-30)
 - bug #4604 Query history not being deleted
 - bug #4057 db/table query string parameters no longer work
 - bug #4605 Unseen messages in tracking
diff --git a/libraries/common.inc.php b/libraries/common.inc.php
index 2227c1e466d8..5cea82360543 100644
--- a/libraries/common.inc.php
+++ b/libraries/common.inc.php
@@ -857,10 +857,13 @@
             PMA_fatalError(
                 __('Invalid authentication method set in configuration:')
                 . ' ' . $cfg['Server']['auth_type']
             );
         }
+        if (isset($_REQUEST['pma_password'])) {
+            $_REQUEST['pma_password'] = substr($_REQUEST['pma_password'], 0, 256);
+        }
         include_once  './libraries/plugins/auth/' . $auth_class . '.class.php';
         // todo: add plugin manager
         $plugin_manager = null;
         $auth_plugin = new $auth_class($plugin_manager);
 
@@ -986,10 +989,12 @@
 
         if (! $controllink) {
             $controllink = $userlink;
         }
 
+        $auth_plugin->storeUserCredentials();
+
         /* Log success */
         PMA_logUser($cfg['Server']['user']);
 
         if (PMA_MYSQL_INT_VERSION < 50500) {
             PMA_fatalError(
diff --git a/libraries/plugins/AuthenticationPlugin.class.php b/libraries/plugins/AuthenticationPlugin.class.php
index 3ddf55ee2060..7943d2cb1564 100644
--- a/libraries/plugins/AuthenticationPlugin.class.php
+++ b/libraries/plugins/AuthenticationPlugin.class.php
@@ -39,10 +39,19 @@ abstract public function authCheck();
      *
      * @return boolean
      */
     abstract public function authSetUser();
 
+    /**
+     * Stores user credentials after successful login.
+     *
+     * @return void
+     */
+    public function storeUserCredentials()
+    {
+    }
+
     /**
      * User is not allowed to login to MySQL -> authentication failed
      *
      * @return boolean
      */
diff --git a/libraries/plugins/auth/AuthenticationCookie.class.php b/libraries/plugins/auth/AuthenticationCookie.class.php
index e21471c5eb99..68cb5d4b354f 100644
--- a/libraries/plugins/auth/AuthenticationCookie.class.php
+++ b/libraries/plugins/auth/AuthenticationCookie.class.php
@@ -555,10 +555,20 @@ public function authSetUser()
         // Avoid showing the password in phpinfo()'s output
         unset($GLOBALS['PHP_AUTH_PW']);
         unset($_SERVER['PHP_AUTH_PW']);
 
         $_SESSION['last_access_time'] = time();
+    }
+
+    /**
+     * Stores user credentials after successful login.
+     *
+     * @return void
+     */
+    public function storeUserCredentials()
+    {
+        global $cfg;
 
         $this->createBlowfishIV();
 
         // Name and password cookies need to be refreshed each time
         // Duration = one month for username

Fixed code: - bug #4611 [security] DOS attack with long passwords
        if (isset($_REQUEST['pma_password'])) {
            $_REQUEST['pma_password'] = substr($_REQUEST['pma_password'], 0, 256);
        }
        $auth_plugin->storeUserCredentials();

    /**
     * Stores user credentials after successful login.
     *
     * @return void
     */
    public function storeUserCredentials()
    {
    }

    }

    /**
     * Stores user credentials after successful login.
     *
     * @return void
     */
    public function storeUserCredentials()
    {
        global $cfg;