exploit the possibilities

Mandriva Linux Security Advisory 2009-026

Mandriva Linux Security Advisory 2009-026
Posted Jan 23, 2009
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2009-026 - phpMyAdmin has been updated to mitigate various cross site scripting and cross site request forgery vulnerabilities.

tags | advisory, vulnerability, xss, csrf
systems | linux, mandriva
advisories | CVE-2008-4775, CVE-2008-5621, CVE-2008-5622
MD5 | 9b139ba25b174440691a508e3f11cb1a

Mandriva Linux Security Advisory 2009-026

Change Mirror Download

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2009:026
http://www.mandriva.com/security/
_______________________________________________________________________

Package : phpMyAdmin
Date : January 23, 2009
Affected: Corporate 4.0
_______________________________________________________________________

Problem Description:

Cross-site scripting (XSS) vulnerability in pmd_pdf.php allows
remote attackers to inject arbitrary web script or HTML by
using db script parameter when register_global php parameter is
enabled (CVE-2008-4775).

Cross-site request forgery (CSRF) vulnerability in tbl_structure.php
allows remote attackers perform SQL injection and execute arbitrary
code by using table script parameter (CVE-2008-5621).

Multiple cross-site request forgery (CSRF) vulnerabilities in allows
remote attackers perform SQL injection by using unknown vectors
related to table script parameter (CVE-2008-5622).

This update provide the fix for these security issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4775
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5621
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5622
_______________________________________________________________________

Updated Packages:

Corporate 4.0:
7589375efc20c24aec34469a8fcc05e8 corporate/4.0/i586/phpMyAdmin-2.11.9.4-0.1.20060mlcs4.noarch.rpm
fb84268bcbb158d12dbf17dade4c6007 corporate/4.0/SRPMS/phpMyAdmin-2.11.9.4-0.1.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
7589375efc20c24aec34469a8fcc05e8 corporate/4.0/x86_64/phpMyAdmin-2.11.9.4-0.1.20060mlcs4.noarch.rpm
fb84268bcbb158d12dbf17dade4c6007 corporate/4.0/SRPMS/phpMyAdmin-2.11.9.4-0.1.20060mlcs4.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJeeYWmqjQ0CJFipgRAjKGAKC8xyS5hfkxIXCdLlwXDCzc8wSSWQCfYhZW
flqnZevpx1QiCbzxUxLB2k4=
=5fPr
-----END PGP SIGNATURE-----

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    16 Files
  • 2
    May 2nd
    8 Files
  • 3
    May 3rd
    8 Files
  • 4
    May 4th
    2 Files
  • 5
    May 5th
    1 Files
  • 6
    May 6th
    15 Files
  • 7
    May 7th
    22 Files
  • 8
    May 8th
    16 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    16 Files
  • 11
    May 11th
    3 Files
  • 12
    May 12th
    4 Files
  • 13
    May 13th
    25 Files
  • 14
    May 14th
    24 Files
  • 15
    May 15th
    78 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    12 Files
  • 18
    May 18th
    2 Files
  • 19
    May 19th
    1 Files
  • 20
    May 20th
    2 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close