{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003ephpMyAdmin 2.x.\u003c/P\u003e",
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 dans l\u0027\u00e9mulation register_global dans le fichier\ngrab_globals.php permet \u00e0 un utilisateur mal intentionn\u00e9 d\u0027\u00e9craser la\nvaleur de la variable import_blacklist afin d\u0027ex\u00e9cuter du code\narbitraire \u00e0 distance sur les postes clients acc\u00e9dant au serveur\ncompromis.\n\n## Solution\n\nAppliquer la mise \u00e0 jour de s\u00e9curit\u00e9 phpMyAdmin en passant \u00e0 la version\n2.7.0-pl1 disponible \u00e0 l\u0027adresse suivante :\n\n    http://sourceforge.net/project/showfiles.php?group_id=23067\n",
  "cves": [],
  "initial_release_date": "2005-12-08T00:00:00",
  "last_revision_date": "2006-01-26T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200512-03 du 11 d\u00e9cembre    2005 :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200512-03.xml"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 phpMyAdmin PMASA-2005-8 du 05 d\u00e9cembre    2005 :",
      "url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SA:2006:004 du 26 janvier    2006 :",
      "url": "http://www.novell.com/linux/security/advisories/2006_04_phpmyadmin.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Hardened-PHP du 07 d\u00e9cembre 2005 :",
      "url": "http://www.hardened-php.net/advisory_252005.110.html"
    },
    {
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 phpMyAdmin version 2.7.0-pl1 :",
      "url": "http://sourceforge.net/project/showfiles.php?group_id=23067"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 phpMyAdmin PMASA-2005-9 du 07 d\u00e9cembre    2005 :",
      "url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 FreeBSD pour phpMyAdmin du 07 d\u00e9cembre    2005 :",
      "url": "http://www.vuxml.org/freebsd/pkg-phpMyAdmin.html"
    }
  ],
  "reference": "CERTA-2005-AVI-484",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2005-12-08T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 Hardened-PHP, ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 phpMyAdmin PMASA-2005-8 et PMASA-2005-9, ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 Gentoo GLSA 200512-03 et FreeBSD et ajout des r\u00e9f\u00e9rences CVE CAN-2005-3665 et CAN-2005-4079.",
      "revision_date": "2005-12-13T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 SUSE.",
      "revision_date": "2006-01-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans phpMyAdmin permet \u00e0 un utilisateur mal\nintentionn\u00e9 de porter atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, de\nr\u00e9aliser des attaques de type Cross Site Scripting ou d\u0027ex\u00e9cuter du code\narbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans phpMyAdmin",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 de phpMyAdmin du 07 d\u00e9cembre 2005",
      "url": null
    }
  ]
}