[Bug 221694] New: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

List overview All Threads
Download

newer

older

[Bug 357051] New: Django 0.96 i18n...

Research: effects of diversity on...

Red Hat Bugzilla

6 Jan 2007 6 Jan '07

9:34 a.m.

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=221694

Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: low Priority: normal Component: phpMyAdmin AssignedTo: imlinux@gmail.com ReportedBy: ville.skytta@iki.fi QAContact: extras-qa@fedoraproject.org CC: fedora-security-list@redhat.com,redhat- bugzilla@linuxnetz.de

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0095

"phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblue_orange/layout.inc.php, which reveals the path in an error message."

FC5+ apparently affected, even though I'm not sure if this is an issue at all.

-- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

Show replies by date

Red Hat Bugzilla

6 Jan 6 Jan

6:05 p.m.

New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=221694

------- Additional Comments From tibbs@math.uh.edu 2007-01-06 12:04 EST ------- For any Fedora installation, you know the path just from inspecting the RPM. But this does disclose that the site is probably run on Fedora, which could conceivably be an issue. Not that our Apache doesn't by default do the same thing, but that's configurable.

So yes, this is an issue, although it's a terribly minor one.

Red Hat Bugzilla

8 Jan 8 Jan

2:42 a.m.

New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=221694

imlinux@gmail.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED

------- Additional Comments From imlinux@gmail.com 2007-01-07 20:42 EST ------- I agree with Tibbs, I'm going to keep an eye on this to see if anything more comes of it I'll update. Otherwise I'll wait until the next version comes out.

Red Hat Bugzilla

20 Jan 20 Jan

11:34 a.m.

New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=221694

imlinux@gmail.com changed:

------- Additional Comments From imlinux@gmail.com 2007-01-20 05:34 EST ------- 2.9.2 is out. Its built and should be on the mirrors soon.

Red Hat Bugzilla

12:03 p.m.

New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=221694

ville.skytta@iki.fi changed:

------- Additional Comments From ville.skytta@iki.fi 2007-01-20 06:03 EST ------- It doesn't look like 2.9.2 fixes this though.

The demo server at http://pma.cihar.com/STABLE/ runs 2.9.2, but directly requesting http://pma.cihar.com/STABLE/themes/darkblue_orange/layout.inc.php after logging in reveals a path:

"Fatal error: Call to a member function getImgPath() on a non-object in /srv/http/pma.cihar.com/STABLE/themes/darkblue_orange/layout.inc.php"

Red Hat Bugzilla

10 Mar 10 Mar

10:33 p.m.

New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=221694

------- Additional Comments From ville.skytta@iki.fi 2007-03-10 16:33 EST ------- The demo server in comment 4 seems to have been updated to 2.10.0.2 but still shows the same problem.

Red Hat Bugzilla

12 Mar 12 Mar

2:29 a.m.

New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=221694

mmcgrath@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|imlinux@gmail.com |mmcgrath@redhat.com

Red Hat Bugzilla

18 Oct 18 Oct

10:06 a.m.

New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

https://bugzilla.redhat.com/show_bug.cgi?id=221694

bugzilla@redhat.com changed:

------- Additional Comments From thoger@redhat.com 2007-10-18 04:06 EST ------- The demo server in comment 4 now advertises usage of 2.11.1.2 and the problem still occurs.

-- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

Red Hat Bugzilla

21 Nov 21 Nov

9:45 p.m.

New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure Alias: CVE-2007-0095

https://bugzilla.redhat.com/show_bug.cgi?id=221694

bugzilla@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Alias| |CVE-2007-0095

------- Additional Comments From redhat-bugzilla@linuxnetz.de 2007-11-21 15:45 EST ------- Same problem on phpMyAdmin 2.11.2.2 further on:

Fatal error: Call to a member function on a non-object in /srv/www/phpMyAdmin/themes/darkblue_orange/layout.inc.php on line 75

-- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

Red Hat Bugzilla

9:47 p.m.

New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure Alias: CVE-2007-0095

https://bugzilla.redhat.com/show_bug.cgi?id=221694

redhat@linuxnetz.de changed:

What |Removed |Added ---------------------------------------------------------------------------- Version|fc6 |devel

-- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

Red Hat Bugzilla

9 Dec 9 Dec

3:08 p.m.

New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure Alias: CVE-2007-0095

https://bugzilla.redhat.com/show_bug.cgi?id=221694

bugzilla@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Version|devel |rawhide

------- Additional Comments From redhat-bugzilla@linuxnetz.de 2007-12-09 09:08 EST ------- Created an attachment (id=282211) --> (https://bugzilla.redhat.com/attachment.cgi?id=282211&action=view) Proposal of a possible fix for CVE-2007-0095

Can somebody please review this patch carefully, because upstream seems not to be interested to solve this issue at all.

-- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

Red Hat Bugzilla

10 Dec 10 Dec

9:44 p.m.

New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure Alias: CVE-2007-0095

https://bugzilla.redhat.com/show_bug.cgi?id=221694

------- Additional Comments From updates@fedoraproject.org 2007-12-10 15:44 EST ------- phpMyAdmin-2.11.3-1.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.

-- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

Red Hat Bugzilla

9:44 p.m.

New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure Alias: CVE-2007-0095

https://bugzilla.redhat.com/show_bug.cgi?id=221694

updates@fedoraproject.org changed:

-- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

Red Hat Bugzilla

9:47 p.m.

New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.

Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure Alias: CVE-2007-0095

https://bugzilla.redhat.com/show_bug.cgi?id=221694

------- Additional Comments From updates@fedoraproject.org 2007-12-10 15:47 EST ------- phpMyAdmin-2.11.3-1.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.

-- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

6206

Age (days ago)

6544

Last active (days ago)

security@lists.fedoraproject.org

13 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla