sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] [SMGLSA-2006-27] phpmyadmin: XSRF vulnerabilities

From: Ladislav Hagara <ladislav.hagara AT unob.cz>
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] [SMGLSA-2006-27] phpmyadmin: XSRF vulnerabilities
Date: Mon, 22 May 2006 15:51:54 +0200

phpMyAdmin security announcement PMASA-2006-3
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-3

Source Mage GNU/Linux Bug 11899
http://bugs.sourcemage.org/show_bug.cgi?id=11899

Summary:
XSRF vulnerabilities

Description:
It was possible to inject arbitrary SQL commands by forcing an authenticated user to follow a crafted link.

Severity:
Such issue is quite common in many PHP applications and users should take care what links they follow. We consider these vulnerabilities to be quite dangerous.

Affected versions:
Some versions previous to 2.8.1 suffer from this vulneribility.
Solution:
Upgrade to phpMyAdmin 2.8.1.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1804

For further information and in case of questions, please contact the phpMyAdmin team. Our website is http://www.phpmyadmin.net/.

-----

phpmyadmin should be updated to version 2.8.1:

# scribe update
# cast -c phpmyadmin

or

# scribe update
# sorcery queue-security
# cast --queue

--
Ladislav Hagara

[SM-Security] [SMGLSA-2006-27] phpmyadmin: XSRF vulnerabilities, Ladislav Hagara, 05/22/2006