Summary
The remote host is missing an update to phpmyadmin announced via advisory DSA 1403-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201403-1
Insight
Omer Singer of the DigiTrust Group discovered several vulnerabilities in phpMyAdmin, an application to administrate MySQL over the WWW. The Common Vulnerabilities and Exposures project identifies the following problems:
CVE-2007-5589
phpMyAdmin allows a remote attacker to inject arbitrary web script or HTML in the context of a logged in user's session (cross site scripting).
CVE-2007-5386
phpMyAdmin, when accessed by a browser that does not URL-encode requests, allows remote attackers to inject arbitrary web script or HTML via the query string.
For the old stable distribution (sarge) this problem has been fixed in version 4:2.6.2-3sarge6.
For the stable distribution (etch) this problem has been fixed in version 4:2.9.1.1-6.
For the unstable distribution (sid) this problem has been fixed in version 4:2.11.1.2-1.
We recommend that you upgrade your phpmyadmin package.
Severity
Classification
-
CVE CVE-2007-5386, CVE-2007-5589 -
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
Related Vulnerabilities