Nessus Plugin #15511

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

[GLSA-200410-14] phpMyAdmin: Vulnerability in MIME-based transformation system

Family:

Gentoo Local Security Checks

Category:

infos

Copyright:

(C) 2004 Michel Arboi

Summary:

phpMyAdmin: Vulnerability in MIME-based transformation system

Version:

$Revision: 1.1 $

Cve_id:

-

Bugtraq_id:

-

Xrefs:

GLSA:200410-14

Description:

The remote host is affected by the vulnerability described in GLSA-200410-14
(phpMyAdmin: Vulnerability in MIME-based transformation system)


A defect was found in phpMyAdmin's MIME-based transformation system, when
used with "external" transformations.

Impact

A remote attacker could exploit this vulnerability to execute arbitrary
commands on the server with the rights of the HTTP server user.

Workaround

Enabling PHP safe mode ("safe_mode = On" in php.ini) may serve as a
temporary workaround.

References:
http://sourceforge.net/forum/forum.php?forum_id=414281
http://secunia.com/advisories/12813/


Solution:
All phpMyAdmin users should upgrade to the latest version:
# emerge sync
# emerge -pv ">=dev-db/phpmyadmin-2.6.0_p2"
# emerge ">=dev-db/phpmyadmin-2.6.0_p2"


Risk factor : High