blob: aa2df98dbee6b4b97a30bafe0a4c35d3cf0cf9b5 [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200510-16">
<title>phpMyAdmin: Local file inclusion vulnerability</title>
phpMyAdmin contains a local file inclusion vulnerability that may lead to
the execution of arbitrary code.
<product type="ebuild">phpmyadmin</product>
<announced>October 17, 2005</announced>
<revised>May 22, 2006: 02</revised>
<package name="dev-db/phpmyadmin" auto="yes" arch="*">
<unaffected range="ge">2.6.4_p2</unaffected>
<vulnerable range="lt">2.6.4_p2</vulnerable>
phpMyAdmin is a tool written in PHP intended to handle the
administration of MySQL over the web.
Maksymilian Arciemowicz reported that in
libraries/grab_globals.lib.php, the $__redirect parameter was not
correctly validated. Systems running PHP in safe mode are not affected.
<impact type="normal">
A local attacker may exploit this vulnerability by sending malicious
requests, causing the execution of arbitrary code with the rights of
the user running the web server.
Run PHP in safe mode.
All phpMyAdmin users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=dev-db/phpmyadmin-2.6.4_p2&quot;</code>
<uri link="">PMASA-2005-4</uri>
<uri link="">CVE-2005-3299</uri>
<metadata tag="requester" timestamp="Sat, 15 Oct 2005 08:08:40 +0000">
<metadata tag="bugReady" timestamp="Sun, 16 Oct 2005 19:41:39 +0000">
<metadata tag="submitter" timestamp="Mon, 17 Oct 2005 03:54:58 +0000">