Bug 860318 (CVE-2012-5159)

Summary:	CVE-2012-5159 phpmyadmin: cdnetworks-kr-1 used to distribute modified archive of phpMyAdmin, containing a backdoor (PMASA-2012-5)
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	redhat-bugzilla
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-11-23 16:55:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	860322

Description Jan Lieskovsky 2012-09-25 15:06:48 UTC

A security incident in phpMyAdmin archive distribution has been reported:
[1] http://www.phpmyadmin.net/home_page/security/PMASA-2012-5.php
[2] http://secunia.com/advisories/50703/

More from [1]:
"One of the SourceForge.net mirrors, namely cdnetworks-kr-1, was being used to distribute a modified archive of phpMyAdmin, which includes a backdoor. This backdoor is located in file server_sync.php and allows an attacker to remotely execute PHP code. Another file, js/cross_framing_protection.js, has also been modified."

Comment 1 Jan Lieskovsky 2012-09-25 15:09:17 UTC

CVE request:
[3] http://www.openwall.com/lists/oss-security/2012/09/25/11

Comment 2 Jan Lieskovsky 2012-09-25 15:10:39 UTC

This issue did NOT affect the versions of the phpMyAdmin package, as shipped with Fedora release of 16 and 17.

--

This issue did NOT affect the versions of the phpMyAdmin package, as shipped with Fedora EPEL 5 and Fedora EPEL 6.

--

This issue did NOT affect the version of the phpMyAdmin package, as shipped with Fedora EPEL 5.