Summary: | dev-db/phpmyadmin <2.11.8 Link/IMG CSRF, setup.php XSS, cross-site frame inclusion (CVE-2008-{3197,3456,3457}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Robert Buchholz (RETIRED) <rbu> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | minor | CC: | web-apps |
Priority: | High | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
URL: | http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5 | ||
Whiteboard: | B4 [noglsa] | ||
Package list: | Runtime testing required: | --- |
Description
Robert Buchholz (RETIRED)
2008-07-16 21:26:21 UTC
There are even more issues: http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6 Secunia writes [1]: Aung Khant has reported two vulnerabilities in phpMyAdmin, which can be exploited by malicious local users to conduct cross-site scripting attacks, and by malicious people to conduct spoofing attacks. 1) Many scripts except for index.php do not check if they are linked into another site's frames. This can potentially be used for spoofing and phishing attacks. 2) Input from the config/config.inc.php configuration file to scripts/setup.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. [1] http://secunia.com/advisories/31263/ web-apps, please bump. Bumped to 2.11.8. Target archs: alpha amd64 hppa ppc ppc64 sparc x86 Stable for HPPA. alpha/sparc/x86 stable dev-db/phpmyadmin-2.11.8 stable on ppc64 ppc stable amd64 stable Ready for vote, I vote NO. NO too and closing. |