sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] [SMGLSA-2006-17] phpmyadmin: XSS vulnerabilities

From: Ladislav Hagara <ladislav.hagara AT unob.cz>
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] [SMGLSA-2006-17] phpmyadmin: XSS vulnerabilities
Date: Fri, 07 Apr 2006 16:25:35 +0200

From http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1 :

phpMyAdmin security announcement PMASA-2006-1

Announcement-ID: PMASA-2006-1
Date: 2006-04-06

Summary:
XSS vulnerabilities

Description:
It was possible to conduct an XSS attack with a direct call to some scripts under the themes directory. We wish to thank Toni Koivunen/CERT-FI for this advisory.

Severity:
We consider these vulnerabilities to be serious.

Affected versions:
All previous versions that support theming are affected.
Solution:
Upgrade to phpMyAdmin 2.8.0.3 for the fixes in the two included themes. New versions of the custom themes will be posted on our themes download page.

For further information and in case of questions, please contact the phpMyAdmin team. Our website is http://www.phpmyadmin.net/.

-----
phpmyadmin should be updated to version 2.8.0.3:

# scribe update
# cast -c phpmyadmin

or

# scribe update
# sorcery queue-security
# cast --queue

--
Ladislav Hagara

[SM-Security] [SMGLSA-2006-17] phpmyadmin: XSS vulnerabilities, Ladislav Hagara, 04/07/2006