From aa2346e3468ebb55e2073d826d803af244c0c857 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Tue, 1 Jul 2003 11:49:21 +0000 Subject: [PATCH] security alert --- ChangeLog | 3 +++ Documentation.html | 59 +++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 61 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 74ed4483d..4c1f10eb6 100755 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,9 @@ phpMyAdmin - Changelog $Id$ $Source$ +2003-07-01 Marc Delisle + * Documentation.html: faq 8.1 about security alert of 2003-06-18 + 2003-06-30 Marc Delisle * lang/french: update diff --git a/Documentation.html b/Documentation.html index fdf1c67f8..bec1850e7 100755 --- a/Documentation.html +++ b/Documentation.html @@ -2005,7 +2005,8 @@ To create a new, empty mimetype please see libraries/transformations/template_ge Multi-user  -  Browsers  -  Usage tips  -  -Project +Project  -  +Security


@@ -3318,6 +3319,62 @@ To create a new, empty mimetype please see libraries/transformations/template_ge Also, have a look at the Developers section.

+
+

[8. Security ]

+ +

+ [8.1] Security alert, dated 2003-06-18. +

+

+ Last update of this FAQ: 2003-07-01. +

+ The phpMyAdmin's development team received notice of this + security alert. +

+ + The team regrets that the author did not communicate with us before + sending this alert. However, here is our current reply to the points mentionned: +

+

    +
  • "Directory transversal attack" +

    + + This problem had been fixed in version 2.5.0, even if the author reports + the 2.5.2 development version as vulnerable, which we could not reproduce. +

    +
    • +
  • "Remote local file retrieving" +

    + This is a misleading title, as the author tells in his text: + "Note that you can't request files ( only dirs )". +

    +
    • + +
  • "Remote internal directory listing" +

    + It was possible to retrieve the list of phpMyAdmin's directory (which we + doubt can cause any damage), but we fixed this in the upcoming + 2.5.2 version. +

    +
    • + +
  • "XSS and Path disclosures" +

    + Most of the XSS problems have been fixed in version 2.5.0. The rest + have been fixed in the upcoming 2.5.2 version. +

    + We are currently looking at the Path disclosure issue. +

    +
    • +
  • "Information encoding weakness" +

    + We believe that an exploit for this weakness would be difficult + to achieve. However we are currently working to remove this weakness. +

    +
    • +
+ +