Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 83590 - dev-db/phpmyadmin More issues
Summary: dev-db/phpmyadmin More issues
Status: RESOLVED DUPLICATE of bug 83190
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: High normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: SEMI-PUBLIC
Keywords:
Depends on:
Blocks:
 
Reported: 2005-02-28 12:42 UTC by Sune Kloppenborg Jeppesen (RETIRED)
Modified: 2005-07-17 13:06 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2005-02-28 12:42:27 UTC 
Apparently phpMyAdmin has a file disclosure problem too, check these two bugs:

https://sourceforge.net/tracker/index.php?func=detail&aid=1149381&group_id=23067&atid=377408

                (file disclosure via php include)

https://sourceforge.net/tracker/index.php?func=detail&aid=1149383&group_id=23067&atid=377408
                (pathname disclosure of installation)


Both rely on attackers overwriting the phpMyAdmin configuration using
CGI parameters.

Final fix is apparently in CVS at phpMyAdmin:

http://cvs.sourceforge.net/viewcvs.py/phpmyadmin/phpMyAdmin/libraries/grab_globals.lib.php?r1=2.5&r2=2.5.4.3
Comment 1 Thierry Carrez (RETIRED) gentoo-dev 2005-03-01 03:09:55 UTC 
Those bugs are in the Secunia thing already, and fixed in 2.6.1-pl2

*** This bug has been marked as a duplicate of 83190 ***