1. Gentoo Linux Security Advisory
| Advisory Reference | GLSA 200805-02 / phpmyadmin |
| Release Date | May 05, 2008 |
| Latest Revision | May 05, 2008: 01 |
| Impact | low |
| Exploitable | remote |
| Package | Vulnerable versions | Unaffected versions | Architecture(s) |
| dev-db/phpmyadmin | < 2.11.5.2 | >= 2.11.5.2 | All supported architectures |
Related bugreports: #219005
A vulnerability in phpMyAdmin may lead to information disclosure.
phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL databases from a web-browser.
Cezary Tomczak reported that an undefined UploadDir variable exposes an information disclosure vulnerability when running on shared hosts.
A remote attacker with CREATE TABLE permissions can exploit this vulnerability via a specially crafted HTTP POST request in order to read arbitrary files.
There is no known workaround at this time.
All phpMyAdmin users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-db/phpmyadmin-2.11.5.2" |