openSUSE Security Update : phpMyAdmin (openSUSE-SU-2013:1065-1)

medium Nessus Plugin ID 75055

Synopsis

The remote openSUSE host is missing a security update.

Description

This update of phpMyAdmin fixes several security issues.

- update to 3.5.8.1 (2013-04-24)

- [security] Remote code execution (preg_replace), reported by Janek Vind (see PMASA-2013-2)

- [security] Locally Saved SQL Dump File Multiple File Extension Remote Code Execution, reported by Janek Vind (see PMASA-2013-3)

- fix for bnc#824301

- PMASA-2013-2 (CVE-2013-3238)

- fix for bnc#824302

- PMASA-2013-3 (CVE-2013-3239)

- update to 3.5.8 (2013-04-08)

- sf#3828 MariaDB reported as MySQL

- sf#3854 Incorrect header for Safari 6.0

- sf#3705 Attempt to open trigger for edit gives NULL

- Use HTML5 DOCTYPE

- [security] Self-XSS on GIS visualisation page, reported by Janek Vind see PMASA-2013-1

- sf#3800 Incorrect keyhandler behaviour #2

- fix for bnc#814678

- PMASA-2013-1 (CVE-2013-1937)

Solution

Update the affected phpMyAdmin package.

See Also

https://bugzilla.novell.com/show_bug.cgi?id=814678

https://bugzilla.novell.com/show_bug.cgi?id=824301

https://bugzilla.novell.com/show_bug.cgi?id=824302

https://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html

Plugin Details

Severity: Medium

ID: 75055

File Name: openSUSE-2013-524.nasl

Version: 1.6

Type: local

Agent: unix

Published: 6/13/2014

Updated: 1/19/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.0

CVSS v2

Risk Factor: Medium

Base Score: 6

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:phpmyadmin, cpe:/o:novell:opensuse:12.2, cpe:/o:novell:opensuse:12.3

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/13/2013

Exploitable With

Core Impact

Metasploit (phpMyAdmin Authenticated Remote Code Execution via preg_replace())

Reference Information

CVE: CVE-2013-1937, CVE-2013-3238, CVE-2013-3239