Debian Security Advisory

DSA-880-1 phpmyadmin -- several vulnerabilities

Date Reported:

02 Nov 2005

Affected Packages:

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 328501, Bug 335306, Bug 335513.
In the Bugtraq database (at SecurityFocus): BugTraq ID 15169.
In Mitre's CVE dictionary: CVE-2005-2869, CVE-2005-3300, CVE-2005-3301.

More information:

Several cross-site scripting vulnerabilities have been discovered in phpmyadmin, a set of PHP-scripts to administrate MySQL over the WWW. The Common Vulnerabilities and Exposures project identifies the following problems:

CAN-2005-2869
Andreas Kerber and Michal Cihar discovered several cross-site scripting vulnerabilities in the error page and in the cookie login.
CVE-2005-3300
Stefan Esser discovered missing safety checks in grab_globals.php that could allow an attacker to induce phpmyadmin to include an arbitrary local file.
CVE-2005-3301
Tobias Klein discovered several cross-site scripting vulnerabilities that could allow attackers to inject arbitrary HTML or client-side scripting.

The version in the old stable distribution (woody) has probably its own flaws and is not easily fixable without a full audit and patch session. The easier way is to upgrade it from woody to sarge.

For the stable distribution (sarge) these problems have been fixed in version 2.6.2-3sarge1.

For the unstable distribution (sid) these problems have been fixed in version 2.6.4-pl3-1.

We recommend that you upgrade your phpmyadmin package.

Fixed in:

Debian GNU/Linux 3.1 (sarge)

Source:: http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge1.dsc; http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge1.diff.gz; http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2.orig.tar.gz
Architecture-independent component:: http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge1_all.deb

MD5 checksums of the listed files are available in the original advisory.