Path disclosure when some files have been removed.

PMASA-2011-1

Announcement-ID: PMASA-2011-1

Date: 2011-02-08

Summary

Path disclosure when some files have been removed.

Description

When the files README, ChangeLog or LICENSE have been removed from their original place (possibly by the distributor), the scripts used to display these files can show their full path, leading to possible further attacks.

Severity

We consider this vulnerability to be non critical.

Mitigation factor

For the error messages to be displayed, php.ini’s error_reporting must be set to E_ALL and display_errors must be On (these settings are not recommended on a production server in the PHP manual).

Affected Versions

The 2.11.x and 3.3.x versions are affected.

Solution

Upgrade to phpMyAdmin 3.3.9.1 or newer (2.11.11.2 or newer for the older family) or apply the related patch listed below.

References

Thanks to MustLive from Websecurity for reporting this issue.

Assigned CVE ids: CVE-2011-0986

CWE ids: CWE-661 CWE-200

Patches

The following commits have been made to fix this issue:

• 035d002db1e1201e73e560d7d98591563b506a83

The following commits have been made on the 2.11 branch to fix this issue:

• f0e8849034132e2114f1d77d9d37185bc5b49886

The following commits have been made on the 3.3 branch to fix this issue:

• 4c8c7080a76b837ae55cdc5e010c793b389a671a

More information

For further information and in case of questions, please contact the phpMyAdmin team. Our website is phpmyadmin.net.