2:34 a.m.
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=221694
Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information
disclosure
Product: Fedora Extras
Version: fc6
Platform: All
OS/Version: Linux
Status: NEW
Severity: low
Priority: normal
Component: phpMyAdmin
AssignedTo: imlinux(a)gmail.com
ReportedBy: ville.skytta(a)iki.fi
QAContact: extras-qa(a)fedoraproject.org
CC: fedora-security-list(a)redhat.com,redhat-
bugzilla(a)linuxnetz.de
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0095
"phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via
a direct request for themes/darkblue_orange/layout.inc.php, which reveals the
path in an error message."
FC5+ apparently affected, even though I'm not sure if this is an issue at all.
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
11:05 a.m.
New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=221694
------- Additional Comments From tibbs(a)math.uh.edu 2007-01-06 12:04 EST -------
For any Fedora installation, you know the path just from inspecting the RPM.
But this does disclose that the site is probably run on Fedora, which could
conceivably be an issue. Not that our Apache doesn't by default do the same
thing, but that's configurable.
So yes, this is an issue, although it's a terribly minor one.
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
7:42 p.m.
New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=221694
imlinux(a)gmail.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |ASSIGNED
------- Additional Comments From imlinux(a)gmail.com 2007-01-07 20:42 EST -------
I agree with Tibbs, I'm going to keep an eye on this to see if anything more
comes of it I'll update. Otherwise I'll wait until the next version comes out.
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
4:34 a.m.
New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=221694
imlinux(a)gmail.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |CLOSED
Resolution| |NEXTRELEASE
------- Additional Comments From imlinux(a)gmail.com 2007-01-20 05:34 EST -------
2.9.2 is out. Its built and should be on the mirrors soon.
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
5:03 a.m.
New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=221694
ville.skytta(a)iki.fi changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|CLOSED |NEW
Keywords| |Reopened
Resolution|NEXTRELEASE |
------- Additional Comments From ville.skytta(a)iki.fi 2007-01-20 06:03 EST -------
It doesn't look like 2.9.2 fixes this though.
The demo server at http://pma.cihar.com/STABLE/ runs 2.9.2, but directly
requesting http://pma.cihar.com/STABLE/themes/darkblue_orange/layout.inc.php
after logging in reveals a path:
"Fatal error: Call to a member function getImgPath() on a non-object in
/srv/http/pma.cihar.com/STABLE/themes/darkblue_orange/layout.inc.php"
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
3:33 p.m.
New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=221694
------- Additional Comments From ville.skytta(a)iki.fi 2007-03-10 16:33 EST -------
The demo server in comment 4 seems to have been updated to 2.10.0.2 but still
shows the same problem.
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
8:29 p.m.
New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=221694
mmcgrath(a)redhat.com changed:
What |Removed |Added
----------------------------------------------------------------------------
AssignedTo|imlinux(a)gmail.com |mmcgrath(a)redhat.com
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
3:06 a.m.
New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
https://bugzilla.redhat.com/show_bug.cgi?id=221694
bugzilla(a)redhat.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|normal |medium
Product|Fedora Extras |Fedora
------- Additional Comments From thoger(a)redhat.com 2007-10-18 04:06 EST -------
The demo server in comment 4 now advertises usage of 2.11.1.2 and the problem
still occurs.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
2:45 p.m.
New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Alias: CVE-2007-0095
https://bugzilla.redhat.com/show_bug.cgi?id=221694
bugzilla(a)redhat.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Alias| |CVE-2007-0095
------- Additional Comments From redhat-bugzilla(a)linuxnetz.de 2007-11-21 15:45 EST
-------
Same problem on phpMyAdmin 2.11.2.2 further on:
Fatal error: Call to a member function on a non-object in
/srv/www/phpMyAdmin/themes/darkblue_orange/layout.inc.php on line 75
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
2:47 p.m.
New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Alias: CVE-2007-0095
https://bugzilla.redhat.com/show_bug.cgi?id=221694
redhat(a)linuxnetz.de changed:
What |Removed |Added
----------------------------------------------------------------------------
Version|fc6 |devel
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
8:08 a.m.
New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Alias: CVE-2007-0095
https://bugzilla.redhat.com/show_bug.cgi?id=221694
bugzilla(a)redhat.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Version|devel |rawhide
------- Additional Comments From redhat-bugzilla(a)linuxnetz.de 2007-12-09 09:08 EST
-------
Created an attachment (id=282211)
--> (https://bugzilla.redhat.com/attachment.cgi?id=282211&action=view)
Proposal of a possible fix for CVE-2007-0095
Can somebody please review this patch carefully, because upstream seems
not to be interested to solve this issue at all.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
2:44 p.m.
New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Alias: CVE-2007-0095
https://bugzilla.redhat.com/show_bug.cgi?id=221694
------- Additional Comments From updates(a)fedoraproject.org 2007-12-10 15:44 EST -------
phpMyAdmin-2.11.3-1.fc7 has been pushed to the Fedora 7 stable repository. If problems
still persist, please make note of it in this bug report.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
2:44 p.m.
New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Alias: CVE-2007-0095
https://bugzilla.redhat.com/show_bug.cgi?id=221694
updates(a)fedoraproject.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution| |ERRATA
Fixed In Version| |2.11.3-1.fc7
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
2:47 p.m.
New subject: [Bug 221694] CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
Alias: CVE-2007-0095
https://bugzilla.redhat.com/show_bug.cgi?id=221694
------- Additional Comments From updates(a)fedoraproject.org 2007-12-10 15:47 EST -------
phpMyAdmin-2.11.3-1.fc8 has been pushed to the Fedora 8 stable repository. If problems
still persist, please make note of it in this bug report.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
5979
days inactive
6317
days old
security@lists.fedoraproject.org
13 comments
1 participants
participants (1)
-
Red Hat Bugzilla