Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 232007 (CVE-2008-3197)

Summary: dev-db/phpmyadmin <2.11.8 Link/IMG CSRF, setup.php XSS, cross-site frame inclusion (CVE-2008-{3197,3456,3457})
Product: Gentoo Security Reporter: Robert Buchholz (RETIRED) <rbu>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: minor CC: web-apps
Priority: High    
Version: unspecified   
Hardware: All   
OS: All   
Whiteboard: B4 [noglsa]
Package list:
Runtime testing required: ---

Description Robert Buchholz (RETIRED) gentoo-dev 2008-07-16 21:26:21 UTC
CVE-2008-3197 (
  Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before
  allows remote attackers to perform unauthorized actions via a link or IMG tag
  to (1) the "Creating a Database" functionality (db_create.php) and (2)
  unspecified vectors that modify the connection character set.
Comment 1 Christian Hoffmann (RETIRED) gentoo-dev 2008-07-29 16:37:17 UTC
There are even more issues:

Secunia writes [1]:

Aung Khant has reported two vulnerabilities in phpMyAdmin, which can be exploited by malicious local users to conduct cross-site scripting attacks, and by malicious people to conduct spoofing attacks.

1) Many scripts except for index.php do not check if they are linked into another site's frames. This can potentially be used for spoofing and phishing attacks.

2) Input from the config/ configuration file to scripts/setup.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.


web-apps, please bump.
Comment 2 Gunnar Wrobel (RETIRED) gentoo-dev 2008-07-31 20:52:11 UTC
Bumped to 2.11.8.

Target archs:

  alpha amd64 hppa ppc ppc64 sparc x86

Comment 3 Jeroen Roovers (RETIRED) gentoo-dev 2008-08-01 14:34:40 UTC
Stable for HPPA.
Comment 4 Raúl Porcel (RETIRED) gentoo-dev 2008-08-01 18:09:10 UTC
alpha/sparc/x86 stable
Comment 5 Markus Rothe (RETIRED) gentoo-dev 2008-08-02 21:25:46 UTC
dev-db/phpmyadmin-2.11.8 stable on ppc64
Comment 6 Tobias Scherbaum (RETIRED) gentoo-dev 2008-08-03 17:58:57 UTC
ppc stable
Comment 7 Tobias Heinlein (RETIRED) gentoo-dev 2008-08-03 18:29:20 UTC
amd64 stable
Comment 8 Tobias Heinlein (RETIRED) gentoo-dev 2008-08-03 18:30:14 UTC
Ready for vote, I vote NO.
Comment 9 Pierre-Yves Rofes (RETIRED) gentoo-dev 2008-08-03 18:31:40 UTC
NO too and closing.