Detections
Analytics
openSUSE Security Update : phpMyAdmin (openSUSE-SU-2013:1065-1)
medium Nessus Plugin ID 75055
Language:
Synopsis
The remote openSUSE host is missing a security update.Description
This update of phpMyAdmin fixes several security issues.- update to 3.5.8.1 (2013-04-24)
- [security] Remote code execution (preg_replace), reported by Janek Vind (see PMASA-2013-2)
- [security] Locally Saved SQL Dump File Multiple File Extension Remote Code Execution, reported by Janek Vind (see PMASA-2013-3)
- fix for bnc#824301
- PMASA-2013-2 (CVE-2013-3238)
- fix for bnc#824302
- PMASA-2013-3 (CVE-2013-3239)
- update to 3.5.8 (2013-04-08)
- sf#3828 MariaDB reported as MySQL
- sf#3854 Incorrect header for Safari 6.0
- sf#3705 Attempt to open trigger for edit gives NULL
- Use HTML5 DOCTYPE
- [security] Self-XSS on GIS visualisation page, reported by Janek Vind see PMASA-2013-1
- sf#3800 Incorrect keyhandler behaviour #2
- fix for bnc#814678
- PMASA-2013-1 (CVE-2013-1937)
Solution
Update the affected phpMyAdmin package.See Also
https://bugzilla.novell.com/show_bug.cgi?id=814678
https://bugzilla.novell.com/show_bug.cgi?id=824301
https://bugzilla.novell.com/show_bug.cgi?id=824302
https://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html
Plugin Details
Severity: Medium
ID: 75055
File Name: openSUSE-2013-524.nasl
Version: 1.6
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 6/13/2014
Updated: 1/19/2021
Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.0
CVSS v2
Risk Factor: Medium
Base Score: 6
Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vulnerability Information
CPE: cpe:/o:novell:opensuse:12.2, cpe:/o:novell:opensuse:12.3, p-cpe:/a:novell:opensuse:phpmyadmin
Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/13/2013
Exploitable With
Core Impact
Metasploit (phpMyAdmin Authenticated Remote Code Execution via preg_replace())