Debian: New phpmyadmin packages fix cross-site scripting
Posted by Benjamin D. Thomas   
Debian Omer Singer of the DigiTrust Group discovered several vulnerabilities in phpMyAdmin, an application to administrate MySQL over the WWW. The Common Vulnerabilities and Exposures project identifies, phpMyAdmin allows a remote attacker to inject arbitrary web script or HTML in the context of a logged in user's session (cross site scripting).
- --------------------------------------------------------------------------
Debian Security Advisory DSA 1403-1                    security@debian.org
http://www.debian.org/security/                            Thijs Kinkhorst
November 8th, 2007                      http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : phpmyadmin
Vulnerability  : missing input sanitising
Problem-Type   : remote
Debian-specific: no
CVE ID         : CVE-2007-5589 CVE-2007-5386

Omer Singer of the DigiTrust Group discovered several vulnerabilities in
phpMyAdmin, an application to administrate MySQL over the WWW. The Common
Vulnerabilities and Exposures project identifies the following problems:

CVE-2007-5589

    phpMyAdmin allows a remote attacker to inject arbitrary web script
    or HTML in the context of a logged in user's session (cross site
    scripting).

CVE-2007-5386

    phpMyAdmin, when accessed by a browser that does not URL-encode
    requests, allows remote attackers to inject arbitrary web script
    or HTML via the query string.

For the old stable distribution (sarge) this problem has been fixed in
version 4:2.6.2-3sarge6.

For the stable distribution (etch) this problem has been fixed in
version 4:2.9.1.1-6.

For the unstable distribution (sid) this problem has been fixed in
version 4:2.11.1.2-1.

We recommend that you upgrade your phpmyadmin package.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.1 alias sarge
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge6.dsc
      Size/MD5 checksum:      896 6f8e63669094450f8450a808deacff73
    http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge6.diff.gz
      Size/MD5 checksum:    42524 14903fdbe6383e4fa6934e4b955851ec
    http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2.orig.tar.gz
      Size/MD5 checksum:  2654418 05e33121984824c43d94450af3edf267

  Architecture independent components:

    http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge6_all.deb
      Size/MD5 checksum:  2770320 b1cfa31fcc29881a78269f38de1387c6


Debian GNU/Linux 4.0 alias etch
- -------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.9.1.1-6.dsc
      Size/MD5 checksum:     1011 130531a7ffe3fd67421985abc0d7e3c1
    http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.9.1.1-6.diff.gz
      Size/MD5 checksum:    49749 0ea3fc9730fb32d1587e0757d3fbee25
    http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.9.1.1.orig.tar.gz
      Size/MD5 checksum:  3500563 f598509b308bf96aee836eb2338f523c

  Architecture independent components:

    http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.9.1.1-6_all.deb
      Size/MD5 checksum:  3606276 be23322772089af7b429c01b65fe1469

  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org