Bug 896635 (CVE-2014-6300) - VUL-0: CVE-2014-6300: phpMyAdmin: XSRF/CSRF due to DOM based XSS in the micro history feature
Summary: VUL-0: CVE-2014-6300: phpMyAdmin: XSRF/CSRF due to DOM based XSS in the micro...
Status: RESOLVED FIXED
Alias: CVE-2014-6300
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: All openSUSE 13.1
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Christian Wittmer
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-09-14 20:59 UTC by Andreas Stieger
Modified: 2015-02-18 23:06 UTC (History)
5 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2014-09-14 20:59:29 UTC 
From http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php

Announcement-ID: PMASA-2014-10
Date: 2014-09-13
Summary: XSRF/CSRF due to DOM based XSS in the micro history feature
Description:
By deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a DOM based XSS vulnerability in the micro history feature.

Severity: We consider this vulnerability to be critical.

Affected Versions:
4.0.x < 4.0.10.3
4.1.x < 4.1.14.4
4.2.x < 4.2.8.1

Current:
openSUSE:13.1:Update 4.1.14.3
openSUSE:12.3:Update 4.1.14.3
server:php:applications 4.2.8.1
openSUSE:Factory: above submitted
SLE 10: not shipped
SLE 11: not shipped
Comment 1 Andreas Stieger 2014-09-14 21:25:56 UTC 
Please review maintenance request #249178 taking phpMyAdmin to 4.1.14.4 for openSUSE 12.3 and 13.1

Chris...?
Comment 2 Christian Wittmer 2014-09-14 21:38:54 UTC 
Uhmmm, didn't thougt you will fix this. created #249179
Comment 3 Andreas Stieger 2014-09-14 21:41:57 UTC 
(In reply to comment #2)
> Uhmmm, didn't thougt you will fix this. created #249179

No problem. Shall we just go with yours?
Comment 4 Christian Wittmer 2014-09-14 21:49:27 UTC 
(In reply to comment #3)
> (In reply to comment #2)
> > Uhmmm, didn't thougt you will fix this. created #249179
> 
> No problem. Shall we just go with yours?

Ok, thanks. lets go with mine.
Comment 5 Bernhard Wiedemann 2014-09-14 22:00:19 UTC 
This is an autogenerated message for OBS integration:
This bug (896635) was mentioned in
https://build.opensuse.org/request/show/249177 Factory / phpMyAdmin
https://build.opensuse.org/request/show/249179 13.1+12.3 / phpMyAdmin
Comment 6 Marcus Meissner 2014-09-15 06:30:46 UTC 
accepted for maintenance, thanks
Comment 7 Swamp Workflow Management 2014-09-22 13:04:21 UTC 
openSUSE-SU-2014:1150-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 896635
CVE References: CVE-2014-6300
Sources used:
openSUSE 13.1 (src):    phpMyAdmin-4.1.14.4-12.1
openSUSE 12.3 (src):    phpMyAdmin-4.1.14.4-1.20.1