summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat (limited to 'metadata/glsa/glsa-200410-14.xml')
-rw-r--r--metadata/glsa/glsa-200410-14.xml72
1 files changed, 72 insertions, 0 deletions
diff --git a/metadata/glsa/glsa-200410-14.xml b/metadata/glsa/glsa-200410-14.xml
new file mode 100644
index 000000000000..ea26984ea23d
--- /dev/null
+++ b/metadata/glsa/glsa-200410-14.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="200410-14">
+ <title>phpMyAdmin: Vulnerability in MIME-based transformation system</title>
+ <synopsis>
+ A vulnerability has been found in the MIME-based transformation system of
+ phpMyAdmin, which may allow remote execution of arbitrary commands if PHP's
+ "safe mode" is disabled.
+ </synopsis>
+ <product type="ebuild">phpMyAdmin</product>
+ <announced>2004-10-18</announced>
+ <revised count="02">2006-05-22</revised>
+ <bug>67409</bug>
+ <access>remote</access>
+ <affected>
+ <package name="dev-db/phpmyadmin" auto="yes" arch="*">
+ <unaffected range="ge">2.6.0_p2</unaffected>
+ <vulnerable range="lt">2.6.0_p2</vulnerable>
+ </package>
+ </affected>
+ <background>
+ <p>
+ phpMyAdmin is a popular web-based MySQL administration tool written in
+ PHP. It allows users to browse and administer a MySQL database from a
+ web-browser. Transformations are a phpMyAdmin feature allowing plug-ins
+ to rewrite the contents of any column seen in phpMyAdmin's Browsing
+ mode, including using insertion of PHP or JavaScript code.
+ </p>
+ </background>
+ <description>
+ <p>
+ A defect was found in phpMyAdmin's MIME-based transformation system,
+ when used with "external" transformations.
+ </p>
+ </description>
+ <impact type="high">
+ <p>
+ A remote attacker could exploit this vulnerability to execute arbitrary
+ commands on the server with the rights of the HTTP server user.
+ </p>
+ </impact>
+ <workaround>
+ <p>
+ Enabling PHP safe mode ("safe_mode = On" in php.ini) may serve as a
+ temporary workaround.
+ </p>
+ </workaround>
+ <resolution>
+ <p>
+ All phpMyAdmin users should upgrade to the latest version:
+ </p>
+ <code>
+ # emerge sync
+
+ # emerge -pv "&gt;=dev-db/phpmyadmin-2.6.0_p2"
+ # emerge "&gt;=dev-db/phpmyadmin-2.6.0_p2"</code>
+ </resolution>
+ <references>
+ <uri link="https://sourceforge.net/forum/forum.php?forum_id=414281">phpMyAdmin 2.6.0_pl2 Release Announcement</uri>
+ <uri link="https://secunia.com/advisories/12813/">Secunia Advisory SA12813</uri>
+ <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2630">CVE-2004-2630</uri>
+ </references>
+ <metadata tag="requester" timestamp="2004-10-14T19:19:23Z">
+ vorlon078
+ </metadata>
+ <metadata tag="submitter" timestamp="2004-10-16T10:34:28Z">
+ koon
+ </metadata>
+ <metadata tag="bugReady" timestamp="2004-10-17T17:40:28Z">
+ koon
+ </metadata>
+</glsa>