Advisories ยป MGASA-2013-0238

Updated phpmyadmin packages fix security vulnerabilities

Publication date: 29 Jul 2013
Modification date: 30 Jul 2013
Type: security
Affected Mageia releases : 2 , 3
CVE: CVE-2013-4995 , CVE-2013-4996 , CVE-2013-4997 , CVE-2013-4998 , CVE-2013-5000 , CVE-2013-5002 , CVE-2013-5003

Description

Using a crafted SQL query, it was possible to produce an XSS on the SQL query
form (PMASA-2013-8)(CVE-2013-4995).

In the setup/index.php, using a crafted # hash with a Javascript event,
untrusted JS code could be executed. In the Display chart view, a chart title
containing HTML code was rendered unescaped, leading to possible JavaScript
code execution via events. A malicious user with permission to create
databases or users having HTML tags in their name, could trigger an XSS
vulnerability by issuing a sleep query with a long delay. In the server
status monitor, the query parameters were shown unescaped. By configuring a
malicious URL for the phpMyAdmin logo link in the navigation sidebar,
untrusted script code could be executed when a user clicked the logo.
The setup field for "List of trusted proxies for IP allow/deny" Ajax
validation code returned the unescaped input on errors, leading to possible
JavaScript execution by entering arbitrary HTML (PMASA-2013-9).
Also, due to not properly validating the version.json file, which is fetched
from the phpMyAdmin.net website, could lead to an XSS attack, if a crafted
version.json file would be presented (PMASA-2013-11).
(CVE-2013-4996, CVE-2013-4997)

By calling some scripts that are part of phpMyAdmin in an unexpected way, it
is possible to trigger phpMyAdmin to display a PHP error message which
contains the full path of the directory where phpMyAdmin is installed
(PMASA-2013-12)(CVE-2013-4998, CVE-2013-5000)

When calling schema_export.php with crafted parameters, it is possible to
trigger an XSS (PMASA-2013-14)(CVE-2013-5002).

Due to a missing validation of parameters passed to schema_export.php and
pmd_pdf.php, it was possible to inject SQL statements that would run with the
privileges of the control user. This gives read and write access to the
tables of the configuration storage database, and if the control user has the
necessary privileges, read access to some tables of the mysql database
(PMASA-2013-15)(CVE-2013-5003).

References

SRPMS

3/core

2/core