Nessus Plugin #16006

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

[GLSA-200412-19] phpMyAdmin: Multiple vulnerabilities

Family:

Gentoo Local Security Checks

Category:

infos

Copyright:

(C) 2004 Michel Arboi

Summary:

phpMyAdmin: Multiple vulnerabilities

Version:

$Revision: 1.1 $

Cve_id:

CAN-2004-1147, CAN-2004-1148

Bugtraq_id:

-

Xrefs:

GLSA:200412-19

Description:

The remote host is affected by the vulnerability described in GLSA-200412-19
(phpMyAdmin: Multiple vulnerabilities)


Nicolas Gregoire (exaprobe.com) has discovered two vulnerabilities
that exist only on a webserver where PHP safe_mode is off. These
vulnerabilities could lead to command execution or file disclosure.

Impact

On a system where external MIME-based transformations are enabled,
an attacker can insert offensive values in MySQL, which would start a
shell when the data is browsed. On a system where the UploadDir is
enabled, read_dump.php could use the unsanitized sql_localfile variable
to disclose a file.

Workaround

You can temporarily enable PHP safe_mode or disable external
MIME-based transformation AND disable the UploadDir. But instead, we
strongly advise to update your version to 2.6.1_rc1.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1147
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1148
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4
http://www.exaprobe.com/labs/advisories/esa-2004-1213.html


Solution:
All phpMyAdmin users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/phpmyadmin-2.6.1_rc1"


Risk factor : High