Bug 14100 - phpmyadmin new security issue CVE-2014-6300
Summary: phpmyadmin new security issue CVE-2014-6300
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/612813/
Whiteboard: MGA3TOO has_procedure advisory mga3-3...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2014-09-16 05:30 CEST by David Walser
Modified: 2014-09-23 18:32 CEST (History)
2 users (show)

See Also:
Source RPM: phpmyadmin-4.1.14.3-1.mga4.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2014-09-16 05:30:48 CEST
Upstream has issued an advisory on September 13:
http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php

Freeze push requested for Cauldron.

Updated packages uploaded for Mageia 3 and Mageia 4.

Advisory:
========================

Updated phpmyadmin package fixes security vulnerability:

In phpMyAdmin before 4.1.14.4, by deceiving a logged-in user to click on a
crafted URL, it is possible to perform remote code execution and in some
cases, create a root account due to a DOM based XSS vulnerability in the
micro history feature (CVE-2014-6300).

References:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6300
http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php
========================

Updated packages in core/updates_testing:
========================
phpmyadmin-4.1.14.4-1.mga3
phpmyadmin-4.1.14.4-1.mga4

from SRPMS:
phpmyadmin-4.1.14.4-1.mga3.src.rpm
phpmyadmin-4.1.14.4-1.mga4.src.rpm

Reproducible: 

Steps to Reproduce:
Comment 1 David Walser 2014-09-16 05:31:27 CEST
Testing procedure:
https://bugs.mageia.org/show_bug.cgi?id=12834#c7

Whiteboard: (none) => MGA3TOO has_procedure

Comment 2 Samuel Verschelde 2014-09-16 09:04:12 CEST
Testing complete mga4 64

CC: (none) => stormi
Whiteboard: MGA3TOO has_procedure => MGA3TOO has_procedure MGA4-64-OK

Comment 3 claire robinson 2014-09-16 13:29:17 CEST
Testing complete mga3 32

Whiteboard: MGA3TOO has_procedure MGA4-64-OK => MGA3TOO has_procedure mga3-32-ok MGA4-64-OK

Comment 4 claire robinson 2014-09-16 14:00:47 CEST
Testing complete mga3 64

Whiteboard: MGA3TOO has_procedure mga3-32-ok MGA4-64-OK => MGA3TOO has_procedure mga3-32-ok mga3-64-ok MGA4-64-OK

Comment 5 claire robinson 2014-09-16 14:18:19 CEST
Testing complete mga4 32

Whiteboard: MGA3TOO has_procedure mga3-32-ok mga3-64-ok MGA4-64-OK => MGA3TOO has_procedure mga3-32-ok mga3-64-ok mga4-32-ok MGA4-64-OK

Comment 6 claire robinson 2014-09-16 14:23:16 CEST
Validating. Advisory uploaded.

Could sysadmin please push to 3 & 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: MGA3TOO has_procedure mga3-32-ok mga3-64-ok mga4-32-ok MGA4-64-OK => MGA3TOO has_procedure advisory mga3-32-ok mga3-64-ok mga4-32-ok MGA4-64-OK
CC: (none) => sysadmin-bugs

Comment 7 Mageia Robot 2014-09-22 10:31:58 CEST
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2014-0383.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

David Walser 2014-09-23 18:32:34 CEST

URL: (none) => http://lwn.net/Vulnerabilities/612813/


Note You need to log in before you can comment on or make changes to this bug.