Home | Docs | Forums | Lists | Bugs | Planet | Store | GMN | Get Gentoo!
Not eligible to see or edit group visibility for this bug.
View Bug Activity | Format For Printing | XML | Clone This Bug
TITLE: phpMyAdmin Local File Inclusion and Cross-Site Scripting SECUNIA ADVISORY ID: SA14382 VERIFY ADVISORY: http://secunia.com/advisories/14382/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting, Exposure of sensitive information WHERE: >From remote SOFTWARE: phpMyAdmin 2.x http://secunia.com/product/1720/ phpMyAdmin 1.x http://secunia.com/product/1719/ DESCRIPTION: Maksymilian Arciemowicz has reported some vulnerabilities in phpMyAdmin, which can be exploited by malicious people to conduct cross-site scripting attacks and disclose sensitive information. 1) Input passed to the "strServer", "cfg[BgcolorOne]", and "strServerChoice" parameters in "select_server.lib.php", the "bgcolor" and "row_no" parameters in "display_tbl_links.lib.php", the "left_font_family" parameter in "theme_left.css.php", and the "right_font_family" parameter in "theme_right.css.php" is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Successful exploitation requires that "register_globals" is enabled. 2) Input passed to the "GLOBALS[cfg][ThemePath]" parameter in "phpmyadmin.css.php" and "cfg[Server][extension]" parameter in "database_interface.lib.php" is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources. Successful exploitation requires that "register_globals" is enabled and that "magic_quotes_gpc" is disabled. The vulnerabilities have been reported in version 2.6.1. Other versions may also be affected. It is also possible to disclose the full path to certain scripts by accessing them directly. SOLUTION: Update to version 2.6.1-pl1. http://sourceforge.net/project/showfiles.php?group_id=23067 PROVIDED AND/OR DISCOVERED BY: Maksymilian Arciemowicz ORIGINAL ADVISORY: http://sourceforge.net/tracker/index.php?func=detail&aid=1149383&group_id=23067&atid=377408 http://sourceforge.net/tracker/index.php?func=detail&aid=1149381&group_id=23067&atid=377408
twp, please bump.
"phpMyAdmin 2.6.1-pl2 is released We are sorry to report that the release of 2.6.1-pl1 introduced an instability, producing various problems. This has been fixed, and here is 2.6.1-pl2." http://www.phpmyadmin.net/home_page/
2.6.1-pl2 is in cvs now
arches, pls test and mark phpmyadmin-2.6.1_p2 stable current KEYWORDS="~alpha ~ppc ~hppa ~sparc ~x86 ~amd64 ~mips" target KEYWORDS="alpha ppc hppa sparc x86 amd64 ~mips" _____ http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2
Stable on sparc.
x86 stable
Stable on ppc.
amd64 done
*** Bug 83590 has been marked as a duplicate of this bug. ***
Stable on alpha.
GLSA vote please
I vote YES. We already released a GLSA 200411-36 for a similar issue.
OK I agree, GLSA there will be
Apparently this allows remote PHP file inclusion on some setups.
GLSA 200503-07
ebuild no longer in portage.
