Detections
Analytics
Debian DSA-1824-1 : phpmyadmin - several vulnerabilities
high Nessus Plugin ID 39569
Language:
Synopsis
The remote Debian host is missing a security-related update.Description
Several remote vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems :- CVE-2009-1150 Cross site scripting vulnerability in the export page allow for an attacker that can place crafted cookies with the user to inject arbitrary web script or HTML.
- CVE-2009-1151 Static code injection allows for a remote attacker to inject arbitrary code into phpMyAdmin via the setup.php script. This script is in Debian under normal circumstances protected via Apache authentication.
However, because of a recent worm based on this exploit, we are patching it regardless, to also protect installations that somehow still expose the setup.php script.
Solution
Upgrade the phpmyadmin package.For the old stable distribution (etch), these problems have been fixed in version 2.9.1.1-11.
For the stable distribution (lenny), these problems have been fixed in version 2.11.8.1-5+lenny1.
See Also
https://security-tracker.debian.org/tracker/CVE-2009-1150
Plugin Details
Severity: High
ID: 39569
File Name: debian_DSA-1824.nasl
Version: 1.25
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 6/30/2009
Updated: 12/5/2022
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.5
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:phpmyadmin, cpe:/o:debian:debian_linux:4.0, cpe:/o:debian:debian_linux:5.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/25/2009
Vulnerability Publication Date: 3/26/2009
CISA Known Exploited Vulnerability Due Dates: 4/15/2022
Exploitable With
CANVAS (CANVAS)
Core Impact
Metasploit (PhpMyAdmin Config File Code Injection)
Elliot (Phpmyadmin File Upload)
Reference Information
CVE: CVE-2009-1150, CVE-2009-1151
BID: 34251