LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: July 28th, 2014
Linux Advisory Watch: July 25th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Debian: New phpmyadmin packages fix cross-site scripting Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Debian Omer Singer of the DigiTrust Group discovered several vulnerabilities in phpMyAdmin, an application to administrate MySQL over the WWW. The Common Vulnerabilities and Exposures project identifies, phpMyAdmin allows a remote attacker to inject arbitrary web script or HTML in the context of a logged in user's session (cross site scripting).
- --------------------------------------------------------------------------
Debian Security Advisory DSA 1403-1                    security@debian.org
http://www.debian.org/security/                            Thijs Kinkhorst
November 8th, 2007                      http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : phpmyadmin
Vulnerability  : missing input sanitising
Problem-Type   : remote
Debian-specific: no
CVE ID         : CVE-2007-5589 CVE-2007-5386

Omer Singer of the DigiTrust Group discovered several vulnerabilities in
phpMyAdmin, an application to administrate MySQL over the WWW. The Common
Vulnerabilities and Exposures project identifies the following problems:

CVE-2007-5589

    phpMyAdmin allows a remote attacker to inject arbitrary web script
    or HTML in the context of a logged in user's session (cross site
    scripting).

CVE-2007-5386

    phpMyAdmin, when accessed by a browser that does not URL-encode
    requests, allows remote attackers to inject arbitrary web script
    or HTML via the query string.

For the old stable distribution (sarge) this problem has been fixed in
version 4:2.6.2-3sarge6.

For the stable distribution (etch) this problem has been fixed in
version 4:2.9.1.1-6.

For the unstable distribution (sid) this problem has been fixed in
version 4:2.11.1.2-1.

We recommend that you upgrade your phpmyadmin package.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.1 alias sarge
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge6.dsc
      Size/MD5 checksum:      896 6f8e63669094450f8450a808deacff73
    http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge6.diff.gz
      Size/MD5 checksum:    42524 14903fdbe6383e4fa6934e4b955851ec
    http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2.orig.tar.gz
      Size/MD5 checksum:  2654418 05e33121984824c43d94450af3edf267

  Architecture independent components:

    http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge6_all.deb
      Size/MD5 checksum:  2770320 b1cfa31fcc29881a78269f38de1387c6


Debian GNU/Linux 4.0 alias etch
- -------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.9.1.1-6.dsc
      Size/MD5 checksum:     1011 130531a7ffe3fd67421985abc0d7e3c1
    http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.9.1.1-6.diff.gz
      Size/MD5 checksum:    49749 0ea3fc9730fb32d1587e0757d3fbee25
    http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.9.1.1.orig.tar.gz
      Size/MD5 checksum:  3500563 f598509b308bf96aee836eb2338f523c

  Architecture independent components:

    http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.9.1.1-6_all.deb
      Size/MD5 checksum:  3606276 be23322772089af7b429c01b65fe1469

  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Weekend Edition
Four fake Google haxbots hit YOUR WEBSITE every day
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
The Barnaby Jack Few Knew: Celebrated Hacker Saw Spotlight as 'Necessary Evil'
What I Learned from Edward Snowden at the Hacker Conference
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.