Skip to Content.
Sympa Menu

sm-security - [SM-Security] [lewk@gentoo.org: [Full-disclosure] [ GLSA 200504-08 ] phpMyAdmin: Cross-site scripting vulnerability]

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Andrew <afrayedknot AT thefrayedknot.armory.com>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] [lewk AT gentoo.org: [Full-disclosure] [ GLSA 200504-08 ] phpMyAdmin: Cross-site scripting vulnerability]
  • Date: Wed, 13 Apr 2005 09:56:29 -0700

FYI, we are effected

Grimoire Section Spell Grimoire Version Installed Version
-------- ------- ----- ---------------- -----------------
test devel phpmyadmin 2.6.1-pl3 -
games - - - -
z-rejected - - - -
stable devel phpmyadmin 2.6.1-pl3 -
devel devel phpmyadmin 2.6.1-pl3 -


----- Forwarded message from Luke Macken <lewk AT gentoo.org> -----

Delivered-To: afrayedknot AT thefrayedknot.armory.com
Delivered-To: full-disclosure AT lists.grok.org.uk
Date: Mon, 11 Apr 2005 15:16:44 -0400
From: Luke Macken <lewk AT gentoo.org>
To: gentoo-announce AT gentoo.org
User-Agent: Mutt/1.5.8i
Cc: full-disclosure AT lists.grok.org.uk, bugtraq AT securityfocus.com,
security-alerts AT linuxsecurity.com
Subject: [Full-disclosure] [ GLSA 200504-08 ] phpMyAdmin: Cross-site
scripting vulnerability
X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=0.93.3.1
X-Spam-Level:
X-Spam-Status: No, score=-1.1 required=5.0 tests=BAYES_00,RAZOR2_CHECK
autolearn=no version=3.0.2

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200504-08
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: phpMyAdmin: Cross-site scripting vulnerability
Date: April 11, 2005
Bugs: #87952
ID: 200504-08

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

phpMyAdmin is vulnerable to a cross-site scripting attack.

Background
==========

phpMyAdmin is a tool written in PHP intended to handle the
administration of MySQL databases from a web-browser.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-db/phpmyadmin < 2.6.2_rc1 >= 2.6.2_rc1

Description
===========

Oriol Torrent Santiago has discovered that phpMyAdmin fails to validate
input to the "convcharset" variable, rendering it vulnerable to
cross-site scripting attacks.

Impact
======

By sending a specially-crafted request, an attacker can inject and
execute malicious script code, potentially compromising the victim's
browser.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All phpMyAdmin users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/phpmyadmin-2.6.2_rc1"

References
==========

[ 1 ] PMASA-2005-3
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200504-08.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security AT gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

----- End forwarded message -----



  • [SM-Security] [lewk AT gentoo.org: [Full-disclosure] [ GLSA 200504-08 ] phpMyAdmin: Cross-site scripting vulnerability], Andrew, 04/13/2005

Archive powered by MHonArc 2.6.24.

Top of Page