(PVS) Signatures - Tenable Network Security

Solution: Upgrade or patch according to vendor recommendations.
CVE-2001-0478
phpMyAdmin < 2.5.6-rc1 Traversal Arbitrary File Access (2)
PVS ID: 2419 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:12041
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows attackers to retrieve
sensitive files or data.\n\nThe remote host is running phpMyAdmin, an open-source
software written in PHP to handle the administration of MySQL over the Web.\nIt is
possible to make the remote phpMyAdmin installation read arbitrary data on the remote
host by using a malformed URL.\nAn attacker may use this flaw to read /etc/passwd or any
file that a web server has the right to access.
Solution: Upgrade to phpMyAdmin 2.5.6-rc1 or higher.
CVE-2004-0129
phpMyAdmin < 2.5.2 Multiple Vulnerabilities
PVS ID: 2420 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:11761
Description: Synopsis :\n\nThe remote host may give an attacker information useful for future
attacks.\n\nThe remote host is running phpMyAdmin, an open-source software written in
PHP to handle the administration of MySQL over the Web.\nThe remote version of this
software is vulnerable to several flaws :\n- It may be tricked into disclosing the physical
path of the remote PHP installation\n- It is vulnerable to cross-site scripting, which may
allow an attacker to steal the cookies of your users\n - It is vulnerable to a flaw that may
allow an attacker to list the content of arbitrary directories on the remote server.\nAn
attacker may use these flaws to gain more knowledge about the remote host and therefore
set up more complex attacks against it.
Solution: Upgrade to phpMyAdmin 2.5.2 or higher.
CVE Not available
Passive Vulnerability Scanner (PVS) Signatures
phpMyAdmin < 2.6.0-p12 Multiple Remote Command Execution
PVS ID: 2421 FAMILY: CGI RISK: HIGH NESSUS ID:11761
Description: Synopsis :\n\nThe remote host is vulnerable to an arbitrary 'command insertion'
flaw.\n\nThe remote host is running phpMyAdmin, an open-source software written in PHP
to handle the administration of MySQL over the Web.\nThe remote version of this software
is vulnerable to arbitrary command execution due to a lack of user-supplied data
sanitization.\n
Solution: Upgrade to phpMyAdmin 2.6.0-pl2 or higher.
Family Internet Services 613