Bug 14342 - phpmyadmin new security issue CVE-2014-8326
Summary: phpmyadmin new security issue CVE-2014-8326
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/617976/
Whiteboard: MGA3TOO has_procedure mga4-64-ok mga3...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2014-10-21 23:43 CEST by David Walser
Modified: 2014-10-24 18:54 CEST (History)
3 users (show)

See Also:
Source RPM: phpmyadmin-4.1.14.5-1.mga4.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2014-10-21 23:43:44 CEST
Upstream has issued an advisory today (October 21):
http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php

The issue is fixed in 4.1.14.6 and 4.2.10.1.

Freeze push requested for Cauldron.

Updated packages uploaded for Mageia 3 and Mageia 4.

Advisory:
========================

Updated phpmyadmin package fixes security vulnerability:

In phpMyAdmin before 4.1.14.6, with a crafted database or table name it is
possible to trigger an XSS in SQL debug output when enabled and in server
monitor page when viewing and analysing executed queries (CVE-2014-8326).

References:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8326
http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php
========================

Updated packages in core/updates_testing:
========================
phpmyadmin-4.1.14.6-1.mga3
phpmyadmin-4.1.14.6-1.mga4

from SRPMS:
phpmyadmin-4.1.14.6-1.mga3.src.rpm
phpmyadmin-4.1.14.6-1.mga4.src.rpm

Reproducible: 

Steps to Reproduce:
Comment 1 David Walser 2014-10-21 23:44:16 CEST
Testing procedure:
https://bugs.mageia.org/show_bug.cgi?id=12834#c7
https://bugs.mageia.org/show_bug.cgi?id=14208#c6

Whiteboard: (none) => MGA3TOO has_procedure

Comment 2 Bill Wilkinson 2014-10-22 22:37:58 CEST
Tested mga4-64 with MariaDB

Logged in, created new user with its own database. Entered a row into the database, browsed to make sure it was there, then deleted user and database.  All behaved as expected.

CC: (none) => wrw105
Whiteboard: MGA3TOO has_procedure => MGA3TOO has_procedure mga4-64-ok

Comment 3 Bill Wilkinson 2014-10-22 22:56:20 CEST
mga3-64 tested as above. All behaved as expected.

Whiteboard: MGA3TOO has_procedure mga4-64-ok => MGA3TOO has_procedure mga4-64-ok mga3-64-ok

Comment 4 Bill Wilkinson 2014-10-23 00:08:08 CEST
tested mga3-32 as above, all OK.

Whiteboard: MGA3TOO has_procedure mga4-64-ok mga3-64-ok => MGA3TOO has_procedure mga4-64-ok mga3-64-ok mga3-32-ok

Comment 5 Bill Wilkinson 2014-10-23 00:33:47 CEST
Tested mga4-32 as above, all OK.

Validating.  Ready for push to /core/updates when advisory is uploaded to svn.

Keywords: (none) => validated_update
Whiteboard: MGA3TOO has_procedure mga4-64-ok mga3-64-ok mga3-32-ok => MGA3TOO has_procedure mga4-64-ok mga3-64-ok mga3-32-ok mga4-32-ok
CC: (none) => sysadmin-bugs

Comment 6 Rémi Verschelde 2014-10-23 08:09:52 CEST
Advisory uploaded. CVEs are dangerously nearing the end of their four-digits naming scheme :-o

CC: (none) => remi
Whiteboard: MGA3TOO has_procedure mga4-64-ok mga3-64-ok mga3-32-ok mga4-32-ok => MGA3TOO has_procedure mga4-64-ok mga3-64-ok mga3-32-ok mga4-32-ok advisory

Comment 7 Mageia Robot 2014-10-23 15:28:43 CEST
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2014-0420.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

David Walser 2014-10-24 18:54:41 CEST

URL: (none) => http://lwn.net/Vulnerabilities/617976/


Note You need to log in before you can comment on or make changes to this bug.