CVE-2008-1567: Infoleak
Published Mar 31, 2008
·Updated
phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which allows local users to obtain sensitive information.
Affected Software
23 affected components
phpMyAdmin phpMyAdmin=2.11.1.2
phpMyAdmin phpMyAdmin=2.11.5.0
phpMyAdmin phpMyAdmin=2.10.0.1
phpMyAdmin phpMyAdmin=2.10.0.2
phpMyAdmin phpMyAdmin=2.11.2.2
phpMyAdmin phpMyAdmin=2.11.4.0
phpMyAdmin phpMyAdmin=2.11.2.1
phpMyAdmin phpMyAdmin=2.10.0.0
phpMyAdmin phpMyAdmin=2.11.2.0
phpMyAdmin phpMyAdmin=2.11.1.1
phpMyAdmin phpMyAdmin=2.10.3.0
phpMyAdmin phpMyAdmin=2.11.3.0
phpMyAdmin phpMyAdmin=2.11.0.0
phpMyAdmin phpMyAdmin=2.10.2.0
phpMyAdmin phpMyAdmin=2.11.1.0
phpMyAdmin phpMyAdmin=2.10.1.0
phpMyAdmin phpMyAdmin<2.11.5.1
Debian Debian Linux=4.0
Fedoraproject Fedora=7
Fedoraproject Fedora=8
openSUSE openSUSE=10.2
openSUSE openSUSE=10.3
openSUSE openSUSE=11.0
Remediation
Patch Available
Patch Available
Event History
Mar 31, 2008
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-1567?
CVE-2008-1567 is classified as a medium severity vulnerability due to information disclosure risks.
2
How do I fix CVE-2008-1567?
To fix CVE-2008-1567, upgrade phpMyAdmin to version 2.11.5.1 or later.
3
What data is exposed in CVE-2008-1567?
CVE-2008-1567 exposes MySQL usernames, passwords, and the Blowfish secret key in cleartext.
4
Which versions of phpMyAdmin are affected by CVE-2008-1567?
CVE-2008-1567 affects phpMyAdmin versions prior to 2.11.5.1.
5
Can local users exploit CVE-2008-1567?
Yes, local users can exploit CVE-2008-1567 to access sensitive information stored in session files.