====================================================================

                                CERT-Renater

                      Note d'Information No. 2012/VULN162
____________________________________________________________________

DATE                : 29/03/2012

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : Systems running phpMyAdmin Versions 3.4.x
                                         prior to 3.4.10.2.

======================================================================
http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php
______________________________________________________________________

PMASA-2012-2

Announcement-ID: PMASA-2012-2

Date: 2012-03-28

Summary

Path disclosure due to missing verification of file presence.

Description

The show_config_errors.php scripts did not validate the presence of the
configuration file, so an error message shows the full path of this file,
leading to possible further attacks.

Severity

We consider this vulnerability to be non critical.


Mitigation factor

For the error messages to be displayed, php.ini's error_reporting must
be set to E_ALL and display_errors must be On (these settings are not
recommended on a production server in the PHP manual).


Affected Versions

Versions 3.4.x are affected.

Solution

Upgrade to phpMyAdmin 3.4.10.2 or newer or apply the related patch
listed below.


References

Thanks to Mateusz Goik from AliantSoft for reporting this issue.

Assigned CVE ids: CVE-2012-1902

CWE ids: CWE-20 CWE-200


Patches

Following commits have been made to fix this issue:

    c51817d3b8cb05ff54dca9373c0667e29b8498d4

More information

For further information and in case of questions, please contact the
phpMyAdmin team. Our website is phpmyadmin.net.

======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================