bugtraq - about phpMyAdmin setup.php XSS vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 15 Oct 2007 19:10:12 -0400
From: Marc Delisle <Marc.Delisle@...epsherbrooke.qc.ca>
To: bugtraq@...urityfocus.com
Subject: about phpMyAdmin setup.php XSS vulnerability

Hi,

phpMyAdmin version 2.11.1.1 was released to fix this, along with a 
security announcement: 
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-5

which contains a mitigating factor:

"We could only trigger it when using Internet Explorer with the 'send 
URLs as UTF8' setting disabled. The default value of this setting being 
'enabled' reduces the impact of this problem."

For distros who prefer a small patch:
http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/scripts/setup.php?r1=10637&r2=10748&view=patch

Marc Delisle, for the team