Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 232007 (CVE-2008-3197) - dev-db/phpmyadmin <2.11.8 Link/IMG CSRF, setup.php XSS, cross-site frame inclusion (CVE-2008-{3197,3456,3457})
Summary: dev-db/phpmyadmin <2.11.8 Link/IMG CSRF, setup.php XSS, cross-site frame incl...
Status: RESOLVED FIXED
Alias: CVE-2008-3197
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: High minor (vote)
Assignee: Gentoo Security
URL: http://www.phpmyadmin.net/home_page/s...
Whiteboard: B4 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2008-07-16 21:26 UTC by Robert Buchholz (RETIRED)
Modified: 2008-08-05 01:20 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Buchholz (RETIRED) gentoo-dev 2008-07-16 21:26:21 UTC
CVE-2008-3197 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3197):
  Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1
  allows remote attackers to perform unauthorized actions via a link or IMG tag
  to (1) the "Creating a Database" functionality (db_create.php) and (2)
  unspecified vectors that modify the connection character set.
Comment 1 Christian Hoffmann (RETIRED) gentoo-dev 2008-07-29 16:37:17 UTC
There are even more issues:
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6

Secunia writes [1]:

Aung Khant has reported two vulnerabilities in phpMyAdmin, which can be exploited by malicious local users to conduct cross-site scripting attacks, and by malicious people to conduct spoofing attacks.

1) Many scripts except for index.php do not check if they are linked into another site's frames. This can potentially be used for spoofing and phishing attacks.

2) Input from the config/config.inc.php configuration file to scripts/setup.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.


[1] http://secunia.com/advisories/31263/


web-apps, please bump.
Comment 2 Gunnar Wrobel (RETIRED) gentoo-dev 2008-07-31 20:52:11 UTC
Bumped to 2.11.8.

Target archs:

  alpha amd64 hppa ppc ppc64 sparc x86

Comment 3 Jeroen Roovers (RETIRED) gentoo-dev 2008-08-01 14:34:40 UTC
Stable for HPPA.
Comment 4 Raúl Porcel (RETIRED) gentoo-dev 2008-08-01 18:09:10 UTC
alpha/sparc/x86 stable
Comment 5 Markus Rothe (RETIRED) gentoo-dev 2008-08-02 21:25:46 UTC
dev-db/phpmyadmin-2.11.8 stable on ppc64
Comment 6 Tobias Scherbaum (RETIRED) gentoo-dev 2008-08-03 17:58:57 UTC
ppc stable
Comment 7 Tobias Heinlein (RETIRED) gentoo-dev 2008-08-03 18:29:20 UTC
amd64 stable
Comment 8 Tobias Heinlein (RETIRED) gentoo-dev 2008-08-03 18:30:14 UTC
Ready for vote, I vote NO.
Comment 9 Pierre-Yves Rofes (RETIRED) gentoo-dev 2008-08-03 18:31:40 UTC
NO too and closing.