Joined: 13 Jun 2003
Location: Dresden, Germany
|Posted: Mon Oct 18, 2004 12:41 pm Post subject: [ GLSA 200410-14 ] phpMyAdmin: Vulnerability in MIME-based t
|Gentoo Linux Security Advisory
Title: phpMyAdmin: Vulnerability in MIME-based transformation system (GLSA 200410-14)
Date: October 18, 2004
Updated: May 22, 2006
A vulnerability has been found in the MIME-based transformation system of phpMyAdmin, which may allow remote execution of arbitrary commands if PHP's "safe mode" is disabled.
Vulnerable: < 2.6.0_p2
Unaffected: >= 2.6.0_p2
Architectures: All supported architectures
A defect was found in phpMyAdmin's MIME-based transformation system, when used with "external" transformations.
A remote attacker could exploit this vulnerability to execute arbitrary commands on the server with the rights of the HTTP server user.
Enabling PHP safe mode ("safe_mode = On" in php.ini) may serve as a temporary workaround.
All phpMyAdmin users should upgrade to the latest version:
|# emerge sync
# emerge -pv ">=dev-db/phpmyadmin-2.6.0_p2"
# emerge ">=dev-db/phpmyadmin-2.6.0_p2"
phpMyAdmin 2.6.0_pl2 Release Announcement
Secunia Advisory SA12813
Last edited by GLSA on Tue May 23, 2006 4:18 am; edited 2 times in total