Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 523
Alerts This Week
Warning Icon 1 523

Debian: DSA-1824-1 Critical phpMyAdmin Remote Code Injection

debian
Calendar Grey June 25, 2009
Scroller Debian
- ------------------------------------------------------------------------ Debian Security Advisory
Several remote vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web
Topics%20covered

Topics Covered

security advisory critical Debian remote code injection phpMyAdmin

Summary

CVE-2009-1150

Cross site scripting vulnerability in the export page allow for an
attacker that can place crafted cookies with the user to inject
arbitrary web script or HTML.

CVE-2009-1151

Static code injection allows for a remote attacker to inject arbitrary
code into phpMyAdmin via the setup.php script. This script is in Debian
under normal circumstances protected via Apache authentication.
However, because of a recent worm based on this exploit, we are patching
it regardless, to also protect installations that somehow still expose
the setup.php script.

For the old stable distribution (etch), these problems have been fixed in
version 2.9.1.1-11.

For the stable distribution (lenny), these problems have been fixed in
version 2.11.8.1-5+lenny1.

For the unstable distribution (sid), these problems have been fixed in
version 3.1.3.1-1.

We recommend that you upgrade your phpmyadmin package.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
...

Read the Full Advisory

Severity
critical
Lowest
Low
Medium
High
Critical

Topics%20covered

Topics Covered

security advisory critical Debian remote code injection phpMyAdmin

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.