[ GLSA 200410-14 ] phpMyAdmin: Vulnerability in MIME-based transformation system

[Thierry Carrez <koon () gentoo org>]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200410-14
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: High
     Title: phpMyAdmin: Vulnerability in MIME-based transformation
            system
      Date: October 18, 2004
      Bugs: #67409
        ID: 200410-14

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A vulnerability has been found in the MIME-based transformation system
of phpMyAdmin, which may allow remote execution of arbitrary commands
if PHP's "safe mode" is disabled.

Background
==========

phpMyAdmin is a popular web-based MySQL administration tool written in
PHP. It allows users to browse and administer a MySQL database from a
web-browser. Transformations are a phpMyAdmin feature allowing plug-ins
to rewrite the contents of any column seen in phpMyAdmin's Browsing
mode, including using insertion of PHP or JavaScript code.

Affected packages
=================

    -------------------------------------------------------------------
     Package            /  Vulnerable  /                    Unaffected
    -------------------------------------------------------------------
  1  dev-db/phpmyadmin     < 2.6.0_p2                      >= 2.6.0_p2

Description
===========

A defect was found in phpMyAdmin's MIME-based transformation system,
when used with "external" transformations.

Impact
======

A remote attacker could exploit this vulnerability to execute arbitrary
commands on the server with the rights of the HTTP server user.

Workaround
==========

Enabling PHP safe mode ("safe_mode = On" in php.ini) may serve as a
temporary workaround.

Resolution
==========

All phpMyAdmin users should upgrade to the latest version:

    # emerge sync

    # emerge -pv ">=dev-db/phpmyadmin-2.6.0_p2"
    # emerge ">=dev-db/phpmyadmin-2.6.0_p2"

References
==========

  [ 1 ] phpMyAdmin 2.6.0_pl2 Release Announcement
        http://sourceforge.net/forum/forum.php?forum_id=414281
  [ 2 ] Secunia Advisory SA12813
        http://secunia.com/advisories/12813/

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200410-14.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security () gentoo org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2004 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0

Attachment: signature.asc
Description: OpenPGP digital signature