Bug 456637 (CVE-2008-3456)
| Summary: | phpMyAdmin: Cross-site Framing; XSS in setup.php (PMASA-2008-6 - CVE-2008-3456, CVE-2008-3457) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Robert Scheck <redhat-bugzilla> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | mmcgrath |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6 | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2008-08-05 06:46:05 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Robert Scheck
2008-07-25 07:41:02 UTC
phpMyAdmin-2.11.8-0.1.fc9 has been submitted as an update for Fedora 9 phpMyAdmin-2.11.8-0.1.fc8 has been submitted as an update for Fedora 8 Maybe let us wait for 2.11.8 final which already should be around the corner as per upstream now. Robert, if you prefer to wait, just revoke update request or change type to testing and update it with new build once upstream final is out. Revoked. phpMyAdmin-2.11.8-1.fc8 has been submitted as an update for Fedora 8 phpMyAdmin-2.11.8-1.fc9 has been submitted as an update for Fedora 9 Okay, here we can go now ;-) Bah! phpMyAdmin 2.11.8 is already obsoleted by 2.11.8.1 which is currently building... phpMyAdmin-2.11.8.1-1.fc8 has been submitted as an update for Fedora 8 phpMyAdmin-2.11.8.1-1.fc9 has been submitted as an update for Fedora 9 phpMyAdmin-2.11.8.1-1.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report. phpMyAdmin-2.11.8.1-1.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report. CVE-2008-3456: phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from using frames that point to pages in other domains, which makes it easier for remote attackers to conduct spoofing or phishing activities via a cross-site framing attack. CVE-2008-3457: Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php. |