Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter in the "Creating a Database" functionality (db_create.php), and (2) the convcharset and collation_connection parameters related to an unspecified program that modifies the connection character set.

This is a version upgrade to phpMyAdmin 2.11.9.4 to fix various security bugs. (CVE-2008-2960, CVE-2008-3197, CVE-2008-1149, CVE-2008-1567, CVE-2008-1924, CVE-2008-4096, CVE-2008-4326, CVE-2008-5621, CVE-2008-5622)

Several remote vulnerabilities have been discovered in phpMyAdmin, a tool to administrate MySQL databases over the web. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-4096     Remote authenticated users could execute arbitrary code     on the host running phpMyAdmin through manipulation of a     script parameter.

  - CVE-2008-3457     Cross site scripting through the setup script was     possible in rare circumstances.

  - CVE-2008-3456     Protection has been added against remote websites     loading phpMyAdmin into a frameset.

  - CVE-2008-3197     Cross site request forgery allowed remote attackers to     create a new database, but not perform any other action     on it.

This update solves a not yet clearly documented security issue with phpMyAdmin.

  - [interface] New field cannot be auto-increment and     primary key - [dbi] Incorrect interpretation for some     mysqli field flags - [display] part 1: do not display a     TEXT utf8_bin as BLOB (fixed for mysqli extension only)
    - [interface] sanitize the after_field parameter, thanks     to Norman Hippert - [structure] do not remove the BINARY     attribute in drop-down - [session] Overriding     session.hash_bits_per_character - [interface] sanitize     the table comments in table print view, thanks to Norman     Hippert - [general] Auto_Increment selected for     TimeStamp by Default - [display] No tilde for InnoDB row     counter when we know it for sure, thanks to Vladyslav     Bakayev - dandy76 - [display] alt text causes duplicated     strings - [interface] Cannot upload BLOB into existing     row - [export] HTML in exports getting corrupted, thanks     to Jason Judge - jasonjudge - [interface] BINARY not     treated as BLOB: update/delete issues - [security]     protection against XSS when register_globals is on and     .htaccess has no effect, thanks to Tim Starling -     [export] Firefox 3 and .sql.gz (corrupted); detect Gecko     1.9, thanks to Juergen Wind - [security] CSRF by     manipulating the db, convcharset and     collation_connection parameters, thanks to YGN Ethical     Hacker Group     http://www.phpmyadmin.net/home_page/security.php?issue=P     MASA-2008-5

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
40107	openSUSE Security Update : phpMyAdmin (phpMyAdmin-442)	Nessus	SuSE Local Security Checks	high
35449	openSUSE 10 Security Update : phpMyAdmin (phpMyAdmin-5935)	Nessus	SuSE Local Security Checks	high
34254	Debian DSA-1641-1 : phpmyadmin - several vulnerabilities	Nessus	Debian Local Security Checks	high
33540	Fedora 9 : phpMyAdmin-2.11.7.1-1.fc9 (2008-6502)	Nessus	Fedora Local Security Checks	low
33538	Fedora 8 : phpMyAdmin-2.11.7.1-1.fc8 (2008-6450)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2008-3197

high

Tenable Plugins

high

high

high

low

low