U radu programskog paketa phpMyAdmin, namijenjenog operacijskom sustavu Fedora 15, otkrivena su dva sigurnosna propusta. Riječ je o paketu koji služi za upravljanje MySQL bazama podataka putem web sučelja. Propusti su posljedica nepravilnosti u radu "error.php" i "phpinfo.php" skripti. Napadač ih može iskoristiti za izvođenje XSS (eng. cross-site scripting) napada, zaobilaženje autentikacije te otkrivanje osjetljivih informacija. Svim se korisnicima savjetuje instalacija odgovarajućih sigurnosnih zakrpa.

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-3761
2011-03-22 03:25:23
--------------------------------------------------------------------------------

Name        : phpMyAdmin
Product     : Fedora 15
Version     : 3.3.10
Release     : 1.fc15
URL         : http://www.phpmyadmin.net/
Summary     : Web based MySQL browser written in php
Description :
phpMyAdmin is a tool written in PHP intended to handle the administration of
MySQL over the Web. Currently it can create and drop databases,
create/drop/alter tables, delete/edit/add fields, execute any SQL statement,
manage keys on fields, manage privileges, export data into various formats and
is available in over 55 languages.

--------------------------------------------------------------------------------
Update Information:

Changes for 3.3.10.0 (2011-03-19)

 - [structure] Aria table size printed as unknown, thanks to erickoh75 -
erickoh75
 - [structure] Ordering by size gives incorrect results, thanks to Madhura
Jayaratne - madhuracj
 - [core] 0 row(s) affected
 - [core] Edit relational page and page number
 - [security] Minor security fixes, see PMASA-2010-9 and PMASA-2010-10
 - [lang] German update, thanks to Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite..
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #661335 - CVE-2010-4480 phpMyAdmin: XSS vulnerability via crafted
BBCode tag in error.php
        https://bugzilla.redhat.com/show_bug.cgi?id=661335
  [ 2 ] Bug #662366 - CVE-2010-4481 phpMyAdmin: information disclosure flaw
(PMASA-2010-10)
        https://bugzilla.redhat.com/show_bug.cgi?id=662366
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update phpMyAdmin' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce