phpmyadmin: insufficient output sanitizing

Debian Bug report logs - #524804
phpmyadmin: insufficient output sanitizing

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Michael S. Gilbert" <michael.s.gilbert@gmail.com>

To: submit@bugs.debian.org

Subject: phpmyadmin: insufficient output sanitizing

Date: Sun, 19 Apr 2009 21:55:49 -0400

package: phpmyadmin
severity: important
tags: security

hello,

fedora issued a security update for myphpadmin [0]:

  Improvements for 3.1.3.2:  - [security] Insufficient output sanitizing
  when generating configuration file
  http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php

does this problem affect debian and should it be tracked as a security
issue?  thanks.

[0] https://admin.fedoraproject.org/updates/F10/FEDORA-2009-3700

Message #10 received at 524804@bugs.debian.org (full text, mbox, reply):

From: "Michael S. Gilbert" <michael.s.gilbert@gmail.com>

To: 524804@bugs.debian.org

Subject: more info

Date: Mon, 20 Apr 2009 00:15:04 -0400

i was looking at the link as provided in redhat's announcement.  this
seems to be CVE-2009-1285, which debian is already tracking as
unimportant.  however, the phpmyadmin page considers the issue to be
critical.  perhaps the debian severity is too low?

mike

Message #15 received at 524804@bugs.debian.org (full text, mbox, reply):

From: Michal Čihař <nijel@debian.org>

To: "Michael S. Gilbert" <michael.s.gilbert@gmail.com>, 524804@bugs.debian.org

Subject: Re: Bug#524804: more info

Date: Mon, 20 Apr 2009 09:38:40 +0200

[Message part 1 (text/plain, inline)]

Hi

Dne Mon, 20 Apr 2009 00:15:04 -0400
"Michael S. Gilbert" <michael.s.gilbert@gmail.com> napsal(a):

> i was looking at the link as provided in redhat's announcement.  this
> seems to be CVE-2009-1285, which debian is already tracking as
> unimportant.  however, the phpmyadmin page considers the issue to be
> critical.  perhaps the debian severity is too low?

The difference might be in fact that Debian package protects setup
script by htpasswd on installation.

(But I'm not in security team to know real cause of this severity.)

-- 
	Michal Čihař | http://cihar.com | http://blog.cihar.com

[signature.asc (application/pgp-signature, attachment)]

Message #20 received at 524804-done@bugs.debian.org (full text, mbox, reply):

From: "Thijs Kinkhorst" <thijs@debian.org>

To: "Michael S. Gilbert" <michael.s.gilbert@gmail.com>, 524804-done@bugs.debian.org

Subject: Re: Bug#524804: more info

Date: Mon, 20 Apr 2009 12:52:28 +0200

Version: 4:3.1.3.2-1

On Mon, April 20, 2009 06:15, Michael S. Gilbert wrote:
> i was looking at the link as provided in redhat's announcement.  this
> seems to be CVE-2009-1285, which debian is already tracking as
> unimportant.  however, the phpmyadmin page considers the issue to be
> critical.  perhaps the debian severity is too low?

This is because Debian by default protects the setup.php page with a
htaccess-style login and the config file is not writable, thus making the
vulnerability hard to exploit. I commented this reasoning in my commit
message to the tracker.

As you can also find in the security tracker:
http://security-tracker.debian.net/tracker/CVE-2009-1285
all affected suites (squeeze/sid) are already updated with the new
version. Therefore we can close this bug.

I appreciate your effort in filing security bugs, but it helps to cross
reference them to the security tracker before so we prevent unnecessary
filings.


thanks,
Thijs

Message #25 received at 524804@bugs.debian.org (full text, mbox, reply):

From: "Michael S. Gilbert" <michael.s.gilbert@gmail.com>

To: 524804@bugs.debian.org

Subject: Re: Bug#524804: more info

Date: Mon, 20 Apr 2009 09:53:33 -0400

On Mon, 20 Apr 2009 12:52:28 +0200, Thijs Kinkhorst wrote:
> On Mon, April 20, 2009 06:15, Michael S. Gilbert wrote:
> > i was looking at the link as provided in redhat's announcement.  this
> > seems to be CVE-2009-1285, which debian is already tracking as
> > unimportant.  however, the phpmyadmin page considers the issue to be
> > critical.  perhaps the debian severity is too low?
> 
> This is because Debian by default protects the setup.php page with a
> htaccess-style login and the config file is not writable, thus making the
> vulnerability hard to exploit. I commented this reasoning in my commit
> message to the tracker.

wouldn't it be better to do this with a 'NOTE' since that is
permanently associated with the CVE number?  i would have certainly
noticed the justification if that was the case.

> As you can also find in the security tracker:
> http://security-tracker.debian.net/tracker/CVE-2009-1285
> all affected suites (squeeze/sid) are already updated with the new
> version. Therefore we can close this bug.
> 
> I appreciate your effort in filing security bugs, but it helps to cross
> reference them to the security tracker before so we prevent unnecessary
> filings.

i had mistakenly missed the CVE number when i first reviewed the
issue.  i appologize for the mistake.

Message #30 received at 524804@bugs.debian.org (full text, mbox, reply):

From: "Thijs Kinkhorst" <thijs@debian.org>

To: "Michael S. Gilbert" <michael.s.gilbert@gmail.com>, 524804@bugs.debian.org

Subject: Re: Bug#524804: more info

Date: Mon, 20 Apr 2009 16:00:12 +0200

On Mon, April 20, 2009 15:53, Michael S. Gilbert wrote:
> On Mon, 20 Apr 2009 12:52:28 +0200, Thijs Kinkhorst wrote:
>
>> On Mon, April 20, 2009 06:15, Michael S. Gilbert wrote:
>>
>>> i was looking at the link as provided in redhat's announcement.  this
>>>  seems to be CVE-2009-1285, which debian is already tracking as
>>> unimportant.  however, the phpmyadmin page considers the issue to be
>>> critical.  perhaps the debian severity is too low?
>>
>> This is because Debian by default protects the setup.php page with a
>> htaccess-style login and the config file is not writable, thus making
>> the vulnerability hard to exploit. I commented this reasoning in my
>> commit message to the tracker.
>
> wouldn't it be better to do this with a 'NOTE' since that is permanently
> associated with the CVE number?  i would have certainly noticed the
> justification if that was the case.

Yes, that's probably better. I'll try to remember.


cheers,
Thijs

Send a report that this bug log contains spam.