Bug 492066 - (CVE-2009-1148, CVE-2009-1149, CVE-2009-1150, CVE-2009-1151) CVE-2009-1148 CVE-2009-1149 CVE-2009-1150 CVE-2009-1151 phpMyAdmin: multiple security fixes in 3.1.3.1 (PMASA-2009-{1,2,3})
CVE-2009-1148 CVE-2009-1149 CVE-2009-1150 CVE-2009-1151 phpMyAdmin: multiple ...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
http://www.phpmyadmin.net/home_page/s...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-03-25 04:54 EDT by Robert Scheck
Modified: 2009-04-14 03:19 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-04-14 03:19:47 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Robert Scheck 2009-03-25 04:54:49 EDT
Description of problem:
Insufficient output sanitizing when generating configuration file, see: 
http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php

Version-Release number of selected component (if applicable):
For 2.11.x: versions before 2.11.9.5.
For 3.x: versions before 3.1.3.1.

-> Affects all active Fedora and EPEL branches.
Comment 1 Fedora Update System 2009-03-25 05:16:48 EDT
phpMyAdmin-3.1.3.1-1.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/phpMyAdmin-3.1.3.1-1.fc9
Comment 2 Fedora Update System 2009-03-25 05:16:49 EDT
phpMyAdmin-3.1.3.1-1.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/phpMyAdmin-3.1.3.1-1.fc10
Comment 3 Robert Scheck 2009-03-25 05:18:48 EDT
1822 (phpMyAdmin): Build on target fedora-4-epel succeeded.
1821 (phpMyAdmin): Build on target fedora-5-epel succeeded.

Package: phpMyAdmin-3.1.3.1-1.fc9 Tag: dist-f9-updates-candidate Status: complete Built by: robert
Package: phpMyAdmin-3.1.3.1-1.fc10 Tag: dist-f10-updates-candidate Status: complete Built by: robert
Package: phpMyAdmin-3.1.3.1-1.fc11 Tag: dist-f11 Status: complete Built by: robert
Comment 4 Tomas Hoger 2009-03-25 10:34:19 EDT
There are actually 3 PMASAs for security issues fixed in 3.1.3.1 and 2.11.9.5:

HTTP Response Splitting and file inclusion vulnerability.
http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php
http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev&revision=12303

Cross-site scripting on export page using cookies
http://www.phpmyadmin.net/home_page/security/PMASA-2009-2.php
http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev&revision=12302

Insufficient output sanitizing when generating configuration file.
http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php
http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev&revision=12301
Comment 5 Fedora Update System 2009-03-25 12:01:31 EDT
phpMyAdmin-3.1.3.1-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2009-03-25 12:04:32 EDT
phpMyAdmin-3.1.3.1-1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Jan Lieskovsky 2009-03-26 11:11:26 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-1148 to
the following vulnerability:

Directory traversal vulnerability in bs_disp_as_mime_type.php in the
BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote
attackers to read arbitrary files via directory traversal sequences in
the file_path parameter ($filename variable).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1148
http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303&r2=12302&pathrev=12303
http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php

-------------------------------------------------------------------------

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-1149 to
the following vulnerability:

CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB
streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers
to inject arbitrary HTTP headers and conduct HTTP response splitting
attacks via the (1) c_type and possibly (2) file_type parameters. 

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1149
http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303&r2=12302&pathrev=12303
http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php

--------------------------------------------------------------------------

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-1150 to
the following vulnerability:

Multiple cross-site scripting (XSS) vulnerabilities in the export page
(display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x
before 3.1.3.1 allow remote attackers to inject arbitrary web script
or HTML via the pma_db_filename_template cookie

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1150
http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/phpMyAdmin/libraries/display_export.lib.php?r1=11986&r2=12302&pathrev=12302
http://www.phpmyadmin.net/home_page/security/PMASA-2009-2.php

----------------------------------------------------------------------------

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-1151 to
the following vulnerability:

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x
before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to
inject arbitrary PHP code into a configuration file via the save
action.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1151
http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514&r2=12301&pathrev=12301
http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php
Comment 8 Robert Scheck 2009-04-13 19:37:23 EDT
Any reason to keep this bug report still open? The packages have been reached
the repositories, I would say and all active branches are covered with fixes.

Note You need to log in before you can comment on or make changes to this bug.