Bug 860318 - (CVE-2012-5159) CVE-2012-5159 phpmyadmin: cdnetworks-kr-1 used to distribute modified archive of phpMyAdmin, containing a backdoor (PMASA-2012-5)
CVE-2012-5159 phpmyadmin: cdnetworks-kr-1 used to distribute modified archive...
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20120925,repor...
: Security
Depends On:
Blocks: 860322
  Show dependency treegraph
 
Reported: 2012-09-25 11:06 EDT by Jan Lieskovsky
Modified: 2012-11-23 11:55 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-11-23 11:55:40 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2012-09-25 11:06:48 EDT
A security incident in phpMyAdmin archive distribution has been reported:
[1] http://www.phpmyadmin.net/home_page/security/PMASA-2012-5.php
[2] http://secunia.com/advisories/50703/

More from [1]:
"One of the SourceForge.net mirrors, namely cdnetworks-kr-1, was being used to distribute a modified archive of phpMyAdmin, which includes a backdoor. This backdoor is located in file server_sync.php and allows an attacker to remotely execute PHP code. Another file, js/cross_framing_protection.js, has also been modified."
Comment 1 Jan Lieskovsky 2012-09-25 11:09:17 EDT
CVE request:
[3] http://www.openwall.com/lists/oss-security/2012/09/25/11
Comment 2 Jan Lieskovsky 2012-09-25 11:10:39 EDT
This issue did NOT affect the versions of the phpMyAdmin package, as shipped with Fedora release of 16 and 17.

--

This issue did NOT affect the versions of the phpMyAdmin package, as shipped with Fedora EPEL 5 and Fedora EPEL 6.

--

This issue did NOT affect the version of the phpMyAdmin package, as shipped with Fedora EPEL 5.

Note You need to log in before you can comment on or make changes to this bug.