Bug 456637 (CVE-2008-3456) - phpMyAdmin: Cross-site Framing; XSS in setup.php (PMASA-2008-6 - CVE-2008-3456, CVE-2008-3457)
Summary: phpMyAdmin: Cross-site Framing; XSS in setup.php (PMASA-2008-6 - CVE-2008-345...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2008-3456
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://www.phpmyadmin.net/home_page/s...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-07-25 07:41 UTC by Robert Scheck
Modified: 2008-08-05 06:46 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2008-08-05 06:46:05 UTC
Embargoed:


Attachments (Terms of Use)

Description Robert Scheck 2008-07-25 07:41:02 UTC
Description of problem:
phpMyAdmin < 2.11.8-rc1 contains two not yet clearly documented security bugs: 
"Welcome to phpMyAdmin 2.11.8-rc1, the first release candidate containing normal 
bug fixes and two security fixes. The security announcement will follow [...]"

Additional info (http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0):
Fixes for 2.11.8.x:
- patch #1987593 [interface] Table list pagination in navi 
- bug #1989081 [profiling] Profiling causes query to be executed again
  (really causes a problem in case of INSERT/UPDATE)
- bug #1990342 [import] SQL file import very slow on Windows
- bug [XHTML] problem with tabindex and radio fields
- bug #1971221 [interface] tabindex not set correctly 
- bug [views] VIEW name created via the GUI was not protected 
  with backquotes 
- bug #1989813 [interface] Deleting multiple views (space in name) 
- bug #1992628 [parser] SQL parser removes essential space 
- bug #1989281 [export] CSV for MS Excel incorrect escaping of 
  double quotes 
- bug #1959855 [interface] Font size option problem when no 
  config file 
- bug #1982489 [relation] Relationship view should check for changes 
- bug [history] Do not save too big queries in history 
- [security] Do not show version info on login screen 
- bug #2018595 [import] Potential data loss on import resubmit 
- patch #2020630 [export] Safari and timedate
- bug #2022182 [import, export] Import/Export fails because of 
  Mac files 
- [security] protection against cross-frame scripting and
  new directive AllowThirdPartyFraming
- [security] possible XSS during setup
- [interface] revert language changing problem introduced 
   with 2.11.7.1

Comment 1 Fedora Update System 2008-07-25 08:13:55 UTC
phpMyAdmin-2.11.8-0.1.fc9 has been submitted as an update for Fedora 9

Comment 2 Fedora Update System 2008-07-25 08:14:07 UTC
phpMyAdmin-2.11.8-0.1.fc8 has been submitted as an update for Fedora 8

Comment 3 Robert Scheck 2008-07-25 08:32:55 UTC
Maybe let us wait for 2.11.8 final which already should be around the corner as 
per upstream now.

Comment 4 Tomas Hoger 2008-07-25 08:47:07 UTC
Robert, if you prefer to wait, just revoke update request or change type to
testing and update it with new build once upstream final is out.

Comment 5 Robert Scheck 2008-07-25 09:24:58 UTC
Revoked.

Comment 6 Fedora Update System 2008-07-28 18:29:06 UTC
phpMyAdmin-2.11.8-1.fc8 has been submitted as an update for Fedora 8

Comment 7 Fedora Update System 2008-07-28 18:29:07 UTC
phpMyAdmin-2.11.8-1.fc9 has been submitted as an update for Fedora 9

Comment 8 Robert Scheck 2008-07-28 18:33:07 UTC
Okay, here we can go now ;-)

Comment 9 Robert Scheck 2008-07-28 20:49:54 UTC
Bah! phpMyAdmin 2.11.8 is already obsoleted by 2.11.8.1 which is currently 
building...

Comment 10 Fedora Update System 2008-07-28 20:55:58 UTC
phpMyAdmin-2.11.8.1-1.fc8 has been submitted as an update for Fedora 8

Comment 11 Fedora Update System 2008-07-28 20:56:08 UTC
phpMyAdmin-2.11.8.1-1.fc9 has been submitted as an update for Fedora 9

Comment 12 Fedora Update System 2008-07-30 20:04:15 UTC
phpMyAdmin-2.11.8.1-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2008-07-30 20:09:01 UTC
phpMyAdmin-2.11.8.1-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 14 Tomas Hoger 2008-08-05 06:45:17 UTC
CVE-2008-3456:
phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from
using frames that point to pages in other domains, which makes it
easier for remote attackers to conduct spoofing or phishing activities
via a cross-site framing attack.

CVE-2008-3457:
Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin
before 2.11.8 allows user-assisted remote attackers to inject
arbitrary web script or HTML via crafted setup arguments.  NOTE: this
issue can only be exploited in limited scenarios in which the attacker
must be able to modify config/config.inc.php.


Note You need to log in before you can comment on or make changes to this bug.