phpMyAdmin vulnerability

phpMyAdmin vulnerability

by Clive Gould -
Number of replies: 1

Hi

Just in case anoyone has got an out of date copy of phpMyAdmin anywhere please read the following posting:

http://www.linuxquestions.org/questions/linux-security-4/y2kupdate-denial-of-service-vulnerability-769247/

Best wishes

Clive

Average of ratings: -
In reply to Clive Gould

Re: phpMyAdmin vulnerability

by Petr Skoda -
Picture of Core developers Picture of Documentation writers Picture of Peer reviewers Picture of Plugin developers
Hello,

your post and linked article does not contain enough information to evaluate this problem.

The full list of vulnerabilities of phpMyAdmin is available from http://www.phpmyadmin.net/home_page/security/. Everybody should upgrade when new version with any fix is available. I would personally recommend all admins using this software package to subscribe to RSS feed on this page.

We are distributing a customised version phpMyAdmin with Moodle, it is updated regularly and each new version is announced at http://moodle.org/security/ - each Moodle server administrator should be subscribed there, you do not need to watch the phpMyAdmin site directly wink

Our customisations and server requirements sometimes neutralise some vulnerabilities, for example Moodle is forcing admins to turn off evil register globals which were the biggest source of security problems in PHP applications.


Petr
(maintainer of phpMyAdmin Moodle integration)
Average of ratings: Useful (2)