The remote host is missing an update to phpmyadmin announced via advisory DSA 880-1. Several cross-site scripting vulnerabilities have been discovered in phpmyadmin, a set of PHP-scripts to administrate MySQL over the WWW. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2005-2869 Andreas Kerber and Michal Cihar discovered several cross-site scripting vulnerabilities in the error page and in the cookie login. CVE-2005-3300 Stefan Esser discovered missing safety checks in grab_globals.php that could allow an attacker to induce phpmyadmin to include an arbitrary local file. CVE-2005-3301 Tobias Klein discovered several cross-site scripting vulnerabilities that could allow attackers to inject arbitrary HTML or client-side scripting. The version in the old stable distribution (woody) has probably its own flaws and is not easily fixable without a full audit and patch session. The easier way is to upgrade it from woody to sarge.

For the stable distribution (sarge) these problems have been fixed in version 2.6.2-3sarge1. For the unstable distribution (sid) these problems have been fixed in version 2.6.4-pl1-1. We recommend that you upgrade your phpmyadmin package. https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20880-1