Debian: New phpmyadmin packages fix several vulnerabilities
Summary
- --------------------------------------------------------------------------Debian Security Advisory DSA 1207-1 security@debian.org http://www.debian.org/security/ Moritz Muehlenhoff November 9th, 2006 http://www.debian.org/security/faq - --------------------------------------------------------------------------Package : phpmyadmin Vulnerability : several Problem-Type : remote Debian-specific: no CVE ID : CVE-2006-1678 CVE-2006-2418 CVE-2005-3621 CVE-2005-3665 CVE-2006-5116 Debian Bug : 339437 340438 362567 368082 391090 Several remote vulnerabilities have been discovered in phpMyAdmin, a program to administrate MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2005-3621 CRLF injection vulnerability allows remote attackers to conduct HTTP response splitting attacks. CVE-2005-3665 Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_HOST variable and (2) various scripts in the libraries directory that handle header generation. CVE-2006-1678 Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML via scripts in the themes directory. CVE-2006-2418 A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the db parameter of footer.inc.php. CVE-2006-5116 A remote attacker could overwrite internal variables through the _FILES global variable. For the stable distribution (sarge) these problems have been fixed in version 2.6.2-3sarge2. For the upcoming stable release (etch) and unstable distribution (sid) these problems have been fixed in version 2.9.0.3-1. We recommend that you upgrade your phpmyadmin package. Upgrade Instructions - --------------------wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.1 alias sarge - -------------------------------- Source archives: Size/MD5 checksum: 604 b650978a6bf3102a49350166d186335e Size/MD5 checksum: 37905 1d1a6528059d2e0420670e557935967b Size/MD5 checksum: 2654418 05e33121984824c43d94450af3edf267 Architecture independent components: Size/MD5 checksum: 2768594 73c65fac24493138f7adb9fddf507d7a These files will probably be moved into the stable distribution on its next update. - ---------------------------------------------------------------------------------For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org
Sign up to get the latest security news affecting Linux and
open source delivered straight to your inbox
Powered By
Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.