Test ID:	1.3.6.1.4.1.25623.1.0.58736
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-1403-1)
Summary:	The remote host is missing an update for the Debian 'phpmyadmin' package(s) announced via the DSA-1403-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'phpmyadmin' package(s) announced via the DSA-1403-1 advisory. Vulnerability Insight: Omer Singer of the DigiTrust Group discovered several vulnerabilities in phpMyAdmin, an application to administrate MySQL over the WWW. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2007-5589 phpMyAdmin allows a remote attacker to inject arbitrary web script or HTML in the context of a logged in user's session (cross site scripting). CVE-2007-5386 phpMyAdmin, when accessed by a browser that does not URL-encode requests, allows remote attackers to inject arbitrary web script or HTML via the query string. For the old stable distribution (sarge) this problem has been fixed in version 4:2.6.2-3sarge6. For the stable distribution (etch) this problem has been fixed in version 4:2.9.1.1-6. For the unstable distribution (sid) this problem has been fixed in version 4:2.11.1.2-1. We recommend that you upgrade your phpmyadmin package. Affected Software/OS: 'phpmyadmin' package(s) on Debian 3.1, Debian 4. Solution: Please install the updated package(s). CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2007-5386 BugTraq ID: 26020 http://www.securityfocus.com/bid/26020 Bugtraq: 20071015 about phpMyAdmin setup.php XSS vulnerability (Google Search) http://www.securityfocus.com/archive/1/482339/100/0/threaded Debian Security Information: DSA-1403 (Google Search) http://www.debian.org/security/2007/dsa-1403 https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00040.html http://www.mandriva.com/security/advisories?name=MDKSA-2007:199 http://www.digitrustgroup.com/advisories/TDG-advisory071009a http://osvdb.org/37678 http://secunia.com/advisories/27173 http://secunia.com/advisories/27506 http://secunia.com/advisories/27595 http://www.vupen.com/english/advisories/2007/3469 XForce ISS Database: phpmyadmin-setup-xss(37077) https://exchange.xforce.ibmcloud.com/vulnerabilities/37077 Common Vulnerability Exposure (CVE) ID: CVE-2007-5589 BugTraq ID: 26301 http://www.securityfocus.com/bid/26301 http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html http://osvdb.org/37939 http://secunia.com/advisories/27246 http://secunia.com/advisories/29323 SuSE Security Announcement: SUSE-SR:2008:006 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html http://www.vupen.com/english/advisories/2007/3535 XForce ISS Database: phpmyadmin-serverstatus-xss(37292) https://exchange.xforce.ibmcloud.com/vulnerabilities/37292
Copyright	Copyright (C) 2008 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.