| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <E1QsWa0-0000c8-IS@titan.mandriva.com> Date: Sun, 14 Aug 2011 11:02:00 +0200 From: security@...driva.com To: full-disclosure@...ts.grok.org.uk Subject: [ MDVSA-2011:124 ] phpmyadmin -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2011:124 http://www.mandriva.com/security/ _______________________________________________________________________ Package : phpmyadmin Date : August 14, 2011 Affected: Enterprise Server 5.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been discovered and corrected in phpmyadmin: libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a remote variable manipulation vulnerability. (CVE-2011-2505). setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array (CVE-2011-2506). libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and consequently execute arbitrary PHP code, by leveraging the ability to modify the SESSION superglobal array (CVE-2011-2507). Directory traversal vulnerability in libraries/display_tbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a certain MIME transformation feature is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in a GLOBALS[mime_map][->name][transformation] parameter (CVE-2011-2508). Multiple cross-site scripting (XSS) vulnerabilities in the table Print view implementation in tbl_printview.php in phpMyAdmin before 3.3.10.3 and 3.4.x before 3.4.3.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name (CVE-2011-2642). Directory traversal vulnerability in sql.php in phpMyAdmin 3.4.x before 3.4.3.2, when configuration storage is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a MIME-type transformation parameter (CVE-2011-2643). Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files via directory traversal sequences in an export type field, related to (1) libraries/schema/User_Schema.class.php and (2) schema_export.php (CVE-2011-2718). libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote attackers to modify the SESSION superglobal array, other superglobal arrays, and certain swekey.auth.lib.php local variables via a crafted query string, a related issue to CVE-2011-2505 (CVE-2011-2719). The updated packages have been upgraded to the 3.4.3.2 version which is not vulnerable to these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2505 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2506 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2507 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2508 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2642 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2643 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2718 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2719 _______________________________________________________________________ Updated Packages: Mandriva Enterprise Server 5: cd0464c4da204a8a252ccb8424318aec mes5/i586/phpmyadmin-3.4.3.2-0.1mdvmes5.2.noarch.rpm 60861f8222ce497b5a71b7a6b37f4b47 mes5/SRPMS/phpmyadmin-3.4.3.2-0.1mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: 9f1d82952b71b146189b98f6ae03cbce mes5/x86_64/phpmyadmin-3.4.3.2-0.1mdvmes5.2.noarch.rpm 60861f8222ce497b5a71b7a6b37f4b47 mes5/SRPMS/phpmyadmin-3.4.3.2-0.1mdvmes5.2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFOR2ORmqjQ0CJFipgRAj06AKDS48As3UETLEh5dgHHrhdGni9SIwCdGzH5 1pwXJ/UmGDgFg3prhv0f494= =sJea -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists