National Cyber Awareness System

Vulnerability Summary for CVE-2011-2719

Overview

libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote attackers to modify the SESSION superglobal array, other superglobal arrays, and certain swekey.auth.lib.php local variables via a crafted query string, a related issue to CVE-2011-2505.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=725384

Type: Patch Information

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=725384

External Source: CONFIRM

Name: http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php

Type: Advisory; Patch Information

Hyperlink:http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php

External Source: MLIST

Name: [oss-security] 20110726 Re: CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12

Type: Patch Information

Hyperlink:http://www.openwall.com/lists/oss-security/2011/07/26/10

External Source: MLIST

Name: [oss-security] 20110725 CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12

Type: Patch Information

Hyperlink:http://www.openwall.com/lists/oss-security/2011/07/25/4

External Source: CONFIRM

Name: http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=e7bb42c002885c2aca7aba4d431b8c63ae4de9b7

Type: Patch Information

Hyperlink:http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=e7bb42c002885c2aca7aba4d431b8c63ae4de9b7

External Source: CONFIRM

Name: http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=571cdc6ff4bf375871b594f4e06f8ad3159d1754

Type: Patch Information

Hyperlink:http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=571cdc6ff4bf375871b594f4e06f8ad3159d1754

External Source: XF

Name: phpmyadmin-swekey-file-overwrite(68769)

Hyperlink:http://xforce.iss.net/xforce/xfdb/68769

External Source: MISC

Name: http://www.xxor.se/advisories/phpMyAdmin_3.x_Conditional_Session_Manipulation.txt

Hyperlink:http://www.xxor.se/advisories/phpMyAdmin_3.x_Conditional_Session_Manipulation.txt

External Source: BID

Name: 48874

Hyperlink:http://www.securityfocus.com/bid/48874

External Source: BUGTRAQ

Name: 20110804 Re: [Full-disclosure] phpMyAdmin 3.x Conditional Session Manipulation

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/519155/100/0/threaded

External Source: BUGTRAQ

Name: 20110724 phpMyAdmin 3.x Conditional Session Manipulation

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/518967/100/0/threaded

External Source: MANDRIVA

Name: MDVSA-2011:124

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2011:124

External Source: DEBIAN

Name: DSA-2286

Hyperlink:http://www.debian.org/security/2011/dsa-2286

External Source: SREASON

Name: 8322

Hyperlink:http://securityreason.com/securityalert/8322

External Source: SECUNIA

Name: 45515

Hyperlink:http://secunia.com/advisories/45515

External Source: SECUNIA

Name: 45365

Type: Advisory

Hyperlink:http://secunia.com/advisories/45365

External Source: SECUNIA

Name: 45315

Hyperlink:http://secunia.com/advisories/45315

External Source: FULLDISC

Name: 20110724 phpMyAdmin 3.x Conditional Session Manipulation

Hyperlink:http://seclists.org/fulldisclosure/2011/Jul/300

External Source: OSVDB

Name: 74112

Hyperlink:http://osvdb.org/74112

External Source: FEDORA

Name: FEDORA-2011-9734

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html

External Source: FEDORA

Name: FEDORA-2011-9725

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html