ID

VAR-200511-0093

CVE

CVE-2005-3621

TITLE

phpMyAdmin CRLF Injection vulnerability

DESCRIPTION

CRLF injection vulnerability in phpMyAdmin before 2.6.4-pl4 allows remote attackers to conduct HTTP response splitting attacks via unspecified scripts. phpMyAdmin is prone to an HTTP-response-splitting vulnerability because the application fails to properly sanitize user-supplied input. A remote attacker may exploit this vulnerability to influence or misrepresent web content is served, cached, or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust. This issue is reported to affect phpMyAdmin version 2.7.0-beta1; other versions may also be vulnerable. The vulnerability is caused due to an error in the register_globals emulation layer in "grab_globals.php" where the "import_blacklist" variable is not properly protected from being overwritten. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. http://www.phpmyadmin.net/home_page/downloads.php PROVIDED AND/OR DISCOVERED BY: Reported by vendor. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1207-2 security@debian.org http://www.debian.org/security/ Moritz Muehlenhoff November 19th, 2006 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : phpmyadmin Vulnerability : several Problem-Type : remote Debian-specific: no CVE ID : CVE-2006-1678 CVE-2006-2418 CVE-2005-3621 CVE-2005-3665 CVE-2006-5116 Debian Bug : 339437 340438 362567 368082 391090 The phpmyadmin update in DSA 1207 introduced a regression. This update corrects this flaw. For completeness, the original advisory text below: Several remote vulnerabilities have been discovered in phpMyAdmin, a program to administrate MySQL over the web. CVE-2005-3665 Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_HOST variable and (2) various scripts in the libraries directory that handle header generation. CVE-2006-1678 Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML via scripts in the themes directory. CVE-2006-5116 A remote attacker could overwrite internal variables through the _FILES global variable. For the stable distribution (sarge) these problems have been fixed in version 2.6.2-3sarge3. For the upcoming stable release (etch) and unstable distribution (sid) these problems have been fixed in version 2.9.0.3-1. We recommend that you upgrade your phpmyadmin package. Upgrade Instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.1 alias sarge - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge3.dsc Size/MD5 checksum: 604 32ee16f4370604bc150d93c5676fface http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge3.diff.gz Size/MD5 checksum: 38520 f27c4b99bbdb3dc13fb71aef99749247 http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2.orig.tar.gz Size/MD5 checksum: 2654418 05e33121984824c43d94450af3edf267 Architecture independent components: http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge3_all.deb Size/MD5 checksum: 2769182 00f14fb52a14546e92ece84c16cd249f These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFYFPdXm3vHE4uyloRAgj5AJ4k0NXBlTZgTK+vJTlgPNTEBfeBGgCg61oX s2aDzIfiBIc0hbLjIGOwEcQ= =EQpq -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ---------------------------------------------------------------------- To improve our services to our customers, we have made a number of additions to the Secunia Advisories and have started translating the advisories to German. The improvements will help our customers to get a better understanding of how we reached our conclusions, how it was rated, our thoughts on exploitation, attack vectors, and scenarios. For more information: SA17578 SA17895 SA19556 SA20113 SA22126 SOLUTION: Apply updated packages. Some input passed to "libraries/header_http.inc.php" isn't properly sanitised before being returned to the user. This can be exploited to include arbitrary HTTP headers in a response sent to the user. Successful exploitation requires that "register_globals" is enabled. It is also possible to disclose the full path to certain scripts by accessing them directly. http://www.phpmyadmin.net/home_page/downloads.php PROVIDED AND/OR DISCOVERED BY: Toni Koivunen ORIGINAL ADVISORY: Toni Koivunen: http://www.fitsec.com/advisories/FS-05-02.txt phpMyAdmin: http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

input validation

EXTERNAL IDS

REFERENCES

CREDITS

Toni Koivunen is credited with the discovery of this vulnerability.

SOURCES

LAST UPDATE DATE

2024-08-14T13:04:05.792000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE