Bug 950102 (CVE-2013-1937)

Summary:	CVE-2013-1937 phpMyAdmin: XSS flaw when displaying GIS Visualization(s) (PMASA-2013-1)
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ccoleman, dmcphers, jialiu, lmeyer, redhat-bugzilla, tkramer
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	phpMyAdmin 3.5.8	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-03-15 04:30:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	950108, 950109
Bug Blocks:	950112

Description Jan Lieskovsky 2013-04-09 15:52:40 UTC

A cross-site scripting (XSS) flaw was found in the way phpMyAdmin, a tool to handle the administration of MySQL over the World Wide Web, sanitized certain input when displaying GIS visualization(s). A remote attacker could provide a specially-crafted URL that, when visited would lead to arbitrary HTML or web script execution in the context of the phpMyAdmin user's session.

References:
[1] http://seclists.org/fulldisclosure/2013/Apr/100

Relevant upstream patch:
[2] https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a

Comment 1 Jan Lieskovsky 2013-04-09 15:58:12 UTC

This issue affects the versions of the phpMyAdmin package, as shipped with Fedora release of 17, 18, and Fedora EPEL-6. Please schedule an update.

--

This issue did NOT affect the version of the phpMyAdmin package, as shipped with Fedora EPEL-5 (the affected functionality was not present in that version yet).

Comment 2 Jan Lieskovsky 2013-04-09 16:04:29 UTC

Created phpMyAdmin tracking bugs for this issue

Affects: fedora-all [bug 950108]
Affects: epel-6 [bug 950109]

Comment 4 Jan Lieskovsky 2013-04-10 13:53:35 UTC

The CVE identifier of CVE-2013-1937 has been assigned to this issue:
  http://www.openwall.com/lists/oss-security/2013/04/09/13

Comment 5 Fedora Update System 2013-04-21 23:54:32 UTC

phpMyAdmin-3.5.8-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2013-04-21 23:55:24 UTC

phpMyAdmin-3.5.8-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2013-04-22 00:40:35 UTC

phpMyAdmin-3.5.8-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Vincent Danen 2013-04-24 21:36:11 UTC

External Reference:

http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php

Comment 9 Fedora Update System 2013-04-27 02:07:24 UTC

phpMyAdmin-3.5.8-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2013-04-29 17:53:27 UTC

phpMyAdmin3-3.5.8-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.