Skip to Content.
Sympa Menu

sm-security - [SM-Security] [SMGLSA-2006-26] phpmyadmin: XSS vulnerabilities II

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Ladislav Hagara <ladislav.hagara AT unob.cz>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] [SMGLSA-2006-26] phpmyadmin: XSS vulnerabilities II
  • Date: Sat, 13 May 2006 23:59:17 +0200

phpMyAdmin security announcement PMASA-2006-2
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2

Source Mage GNU/Linux Bug 11844:
http://bugs.sourcemage.org/show_bug.cgi?id=11844


Summary:
XSS vulnerabilities

Description:
1. It was possible to conduct an XSS attack with a crafted lang or theme parameter.
2. The db parameter was also vulnerable to an XSS attack.

Severity:
We consider these vulnerabilities to be serious.

Affected versions:
[1] All 2.8.0.x releases before 2.8.0.4 are affected, previous versions are not.
[2] Some releases before 2.8.0.4 are affected (2.6.2 tested vulnerable).
Solution:
Upgrade to phpMyAdmin 2.8.0.4.

References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2031
[2] We wish to thank Sven Vetsch/Disenchant for informing us in a responsible manner. His site is http://www.disenchant.ch.

For further information and in case of questions, please contact the phpMyAdmin team. Our website is http://www.phpmyadmin.net/.



-----

phpmyadmin should be updated to version 2.8.0.4:

# scribe update
# cast -c phpmyadmin

or

# scribe update
# sorcery queue-security
# cast --queue


--
Ladislav Hagara




  • [SM-Security] [SMGLSA-2006-26] phpmyadmin: XSS vulnerabilities II, Ladislav Hagara, 05/13/2006

Archive powered by MHonArc 2.6.24.

Top of Page