Bugzilla Bug 196237

2.11.1.2 is now released to fix this vulnerability and some other bugs.
More information about the problem at
http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html
The exact fix:
http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/phpMyAdmin/server_status.php?r1=10704&r2=10797&view=patch


Reproducible: Always

Steps to Reproduce:

Sorry for the noise, but to correct myself, it wasn't only server_status.php
that the phpMyAdmin team fixed up, it was some other files as you can see at
http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev&revision=10796

Added mysql and webapp to CC

Phew...

phpmyadmin-2.11.1.2 in CVS

You know the drill...

Targets: alpha amd64 hppa ppc ppc64 sparc x86 

Stable for HPPA.

ppc stable

ppc64 stable

x86 stable

CVE-2007-5589 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5589):
  Muliple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before
  2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via
  certain input available in (1) PHP_SELF in (a) server_status.php, and (b)
  grab_globals.lib.php, (c) display_change_password.lib.php, and (d)
  common.lib.php in libraries/; and certain input available in PHP_SELF and (2)
  PATH_INFO in libraries/common.inc.php.  NOTE: there might also be other
  vectors related to (3) REQUEST_URI.

amd64 stable

dev-db/phpmyadmin-2.11.1.2

1. Emerges on SPARC64.
2. No collisions.
3. Package includes no tests
4. After struggling with the package for a long time to get the config working,
the file must be on /var/www/<hostname>/htdocs/phpmyadmin/config.inc.php and
not .../phpmyadmin/config/config.inc.php, it worked fine.
I've created a few tables, through the wizard and with sql commands, changed
column definitions searched for data, browsed the tables and dropped a table.

emerge --info:
Portage 2.1.3.9 (default-linux/sparc/sparc64/2007.0, gcc-4.1.2, glibc-2.6.1-r0,
2.6.17-gentoo-r8 sparc64)
=================================================================
System uname: 2.6.17-gentoo-r8 sparc64 sun4u
Timestamp of tree: Sat, 20 Oct 2007 11:50:01 +0000
app-shells/bash:     3.2_p17
dev-lang/python:     2.4.4-r5
dev-python/pycrypto: 2.0.1-r6
sys-apps/baselayout: 1.12.9-r2
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.7.9-r1, 1.10
sys-devel/binutils:  2.18-r1
sys-devel/gcc-config: 1.3.16
sys-devel/libtool:   1.5.24
virtual/os-headers:  2.6.22-r2
ACCEPT_KEYWORDS="sparc"
CBUILD="sparc-unknown-linux-gnu"
CFLAGS="-O2 -mcpu=ultrasparc3 -pipe"
CHOST="sparc-unknown-linux-gnu"
CONFIG_PROTECT="/etc /var/bind"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/php/apache2-php5/ext-active/
/etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild
/etc/terminfo /etc/udev/rules.d"
CXXFLAGS="-O2 -mcpu=ultrasparc3 -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="collision-protection distlocks metadata-transfer parallel-fetch
sandbox sfperms strict test unmerge-orphans userfetch"
GENTOO_MIRRORS="http://ftp.belnet.be/mirror/rsync.gentoo.org/gentoo/
ftp://ftp.gentoo-pt.org/pub/gentoo ftp://mirrors1.netvisao.pt/gentoo/
http://trumpetti.tut.atm.fi/gentoo"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude=/distfiles --exclude=/local --exclude=/packages
--filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://atl64.acores.pt/gentoo-portage"
USE="bitmap-fonts cli cracklib crypt cups dri fortran gdbm gpm iconv isdnlog
midi mudflap nls nptl nptlonly openmp pam pcre ppds pppd reflection session
sparc spl tcpd test truetype-fonts type1-fonts unicode vhosts xorg"
ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file
hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route
share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev"
KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001
mtxorb ncurses text" USERLAND="GNU" VIDEO_CARDS="dummy fbdev glint mach64 mga
r128 radeon sunbw2 suncg14 suncg3 suncg6 sunffb sunleo tdfx v4l voodoo"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS,
LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

Stable on sparc.

In alpha we are having some weird problems with mysql, so please give as a
couple of days to see if can fix them first.

Drop me a comment if this bug is *really* urgent.

Stable in alpha.

Our problem with mysql seems to be kernel related so phpmyadmin doesn't have
anything to do with it. Sorry for the delay.

@security: we are the last arch, ready for you.

Welcome to the polling booth - It's a vote!

Oh, a vote here as well:) I tend to vote YES.

The insecure versions were removed from the tree. webapps is done here.

(In reply to comment #13)
> Oh, a vote here as well:) I tend to vote YES.
> 

Huh? yes for a simple xss? Is there a specific reason? We got at least one vuln
like this every week on a random web-app, and generally speaking we don't
release glsas for just an xss... So voting NO unless you explain me why we
should have a glsa for that :)

I just had to be a bit positive:) Everyone here in .dk tend to vote NO whenever
they get the chance and without any specific reason.

TBH you're absolutely correct so I'm reversing to full NO and closing.