SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Database)  >   phpPgAdmin Vendors:   Great Bridge
phpPgAdmin Administration Tool for PostgreSQL Allows Remote Users to Execute Commands on the Server
SecurityTracker Alert ID:  1001412
SecurityTracker URL:  http://securitytracker.com/id/1001412
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Apr 23 2001
Impact:   Execution of arbitrary code via network
Fix Available:  Yes  
Version(s): phpPgAdmin 2.2.1
Description:   A vulnerability has been reported by Secure Reality in phpPgAdmin, an adminstration tool for PostgreSQL. The hole reportedly allows a remote user to execute commands on the server without authentication.

The report notes that all versions prior to and including v2.2.1 are likely to be vulnerable but were not tested.

No other details were provided in this preliminary advisory.

Impact:   A remote user could execute commands on the phpPgAdmin server.
Solution:   The vendor has released version 2.3 to correct the problem.
Vendor URL:  www.greatbridge.org/project/phppgadmin/projdisplay.php (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents

Subject:  (SRPRE00001) phpMyAdmin 2.1.0 and phpPgAdmin 2.2.1


=================================================
Secure Reality Pty
Ltd. Security Pre-Advisory #1 (SRPRE00001)
http://www.securereality.com.au
=================================================

[Title]
Remote command execution vulnerabilities in phpMyAdmin and phpPgAdmin

[Released]
23/4/2001

This is a pre-release. This vulnerability will be discussed in detail during
Shaun Clowes' speech at the Black Hat briefings in Asia in the week of the
23rd of April. A full advisory will be issued following the conference

[Vulnerable]
phpMyAdmin 2.1.0
phpPgAdmin 2.2.1

All prior versions are almost certainly vulnerable but not tested

[Impact]
Remote command execution by unauthenticated remote users

[Fix]
The Authors have not yet been able to correct the issues in mainstream
versions. SecureReality is providing patches for the problems, no liability
for the performance or effectiveness of these patches is accepted.

phpPgAdmin 2.2.1:
http://www.securereality.com.au/patches/phpPgAdmin-SecureReality.diff
phpMyAdmin 2.2.0:
http://www.securereality.com.au/patches/phpMyAdmin-SecureReality.diff

Users of earlier versions are advised to upgrade to the versions specified
then apply the patches.

To apply the patches:
 - cd to the directory in which the application files are stored (e.g
   /home/httpd/html/phpMyAdmin/)
 - run 'patch -p0 < *Path to patch filename*'

[Disclaimer] Advice, directions and instructions on security
vulnerabilities in this advisory do not constitute: an endorsement of
illegal behavior; a guarantee that protection measures will work; an
endorsement of any product or solution or recommendations on behalf of
Secure Reality Pty Ltd. Content is provided as is and Secure Reality
Pty Ltd does not accept responsibility for any damage or injury caused
as a result of its use.

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC