about phpMyAdmin setup.php XSS vulnerability

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: about phpMyAdmin setup.php XSS vulnerability
From: Marc Delisle <Marc.Delisle@xxxxxxxxxxxxxxxxxxxxx>
Date: Mon, 15 Oct 2007 19:10:12 -0400
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
User-agent: Thunderbird 2.0.0.6 (Windows/20070728)

Hi,

phpMyAdmin version 2.11.1.1 was released to fix this, along with asecurity announcement:http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-5


which contains a mitigating factor:

"We could only trigger it when using Internet Explorer with the 'sendURLs as UTF8' setting disabled. The default value of this setting being'enabled' reduces the impact of this problem."


For distros who prefer a small patch:
http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/scripts/setup.php?r1=10637&r2=10748&view=patch

Marc Delisle, for the team

Prev by Date: CVE-2007-4600 - Mathcad Protect Worksheet Vulnerability
Next by Date: RE: playing for fun with <=IE7
Previous by thread: CVE-2007-4600 - Mathcad Protect Worksheet Vulnerability
Next by thread: IRM Vendor Alerts: Six critical remote vulnerabilities in TIBCO SmartPGM FX
Index(es):
- Date
- Thread