Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[ GLSA 200504-30 ] phpMyAdmin: Insecure SQL script installation
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index News & Announcements
View previous topic :: View next topic  
Author Message
GLSA
Veteran
Veteran


Joined: 12 May 2004
Posts: 1471

PostPosted: Sat Apr 30, 2005 6:44 pm    Post subject: [ GLSA 200504-30 ] phpMyAdmin: Insecure SQL script installat Reply with quote

Gentoo Linux Security Advisory

Title: phpMyAdmin: Insecure SQL script installation (GLSA 200504-30)
Severity: normal
Exploitable: local
Date: April 30, 2005
Updated: May 22, 2006
Bug(s): #88831
ID: 200504-30

Synopsis


phpMyAdmin leaves the SQL install script with insecure permissions,
potentially leading to a database compromise.


Background


phpMyAdmin is a tool written in PHP intended to handle the
administration of MySQL databases from a web-browser. phpMyAdmin uses a
pma MySQL user to control the linked-tables infrastructure. The SQL
install script sets the initial password for the pma user.


Affected Packages

Package: dev-db/phpmyadmin
Vulnerable: < 2.6.2-r1
Unaffected: >= 2.6.2-r1
Architectures: All supported architectures


Description


The phpMyAdmin installation process leaves the SQL install script with
insecure permissions.


Impact


A local attacker could exploit this vulnerability to obtain the initial
phpMyAdmin password and from there obtain information about databases
accessible by phpMyAdmin.


Workaround


Change the password for the phpMyAdmin MySQL user (pma):
Code:

    mysql -u root -p
    SET PASSWORD FOR 'pma'@'localhost' = PASSWORD('MyNewPassword');

Update your phpMyAdmin config.inc.php:
Code:
$cfg['Servers'][$i]['controlpass']   = 'MyNewPassword';


Resolution


All phpMyAdmin users should change password for the pma user as
described above and upgrade to the latest version:
Code:
# emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-db/phpmyadmin-2.6.2-r1"


References

CVE-2005-1392


Last edited by GLSA on Fri Sep 20, 2013 4:20 am; edited 4 times in total
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index News & Announcements All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum