Merge lp:~ari-tczew/ubuntu/dapper/phpmyadmin/fix-CVE-2009-1151 into lp:ubuntu/dapper/phpmyadmin

[Artur Rona]

[Jamie Strandboge (jdstrand)]

Looks like LP was out of date cause it added the previous update to your diff. Looks fine. Thanks!

review: Approve

[Jamie Strandboge (jdstrand)]

Actually, the debian/patches/series file is not needed (it was mistakenly added in the last security update). I removed it.

More importantly, because you used a .dpatch extension, the patch didn't apply. I renamed it to use .patch.

Unmerged revisions

10. By Artur Rona on 2010-04-11

* SECURITY UPDATE: Insufficient output sanitizing when generating
  configuration file (LP: #387215).
  - debian/patches/051_CVE-2009-1151.dpatch: Do not output unescaped
    chars to generated configuration file. Patch from upstream SVN revision
    12301.
  - References:
    + CVE-2009-1151
    + PMASA-2009-3

9. By Emanuele Gentili on 2008-03-14

* SECURITY UPDATE:
 + debian/patches/050_CVE-2008-1149.patch
  - Provides unauthorized access, Allows partial confidentiality, integrity, and
    availability violation , Allows unauthorized disclosure of information ,
    Allows disruption of service. (LP: #198745)

* References:
 + http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1149
 + http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1

=== modified file 'debian/changelog'
--- debian/changelog	2006-04-14 14:47:28 +0000
+++ debian/changelog	2010-04-11 01:26:15 +0000
@@ -1,3 +1,30 @@
+phpmyadmin (4:2.8.0.3-1ubuntu0.2) dapper-security; urgency=low
+
+  * SECURITY UPDATE: Insufficient output sanitizing when generating
+    configuration file (LP: #387215).
+    - debian/patches/051_CVE-2009-1151.dpatch: Do not output unescaped
+      chars to generated configuration file. Patch from upstream SVN revision
+      12301.
+    - References:
+      + CVE-2009-1151
+      + PMASA-2009-3
+
+ -- Artur Rona <[e-mail]>  Sun, 11 Apr 2010 02:16:47 +0200
+
+phpmyadmin (4:2.8.0.3-1ubuntu0.1) dapper-security; urgency=low
+
+  * SECURITY UPDATE:
+   + debian/patches/050_CVE-2008-1149.patch
+    - Provides unauthorized access, Allows partial confidentiality, integrity, and 
+      availability violation , Allows unauthorized disclosure of information , 
+      Allows disruption of service. (LP: #198745)
+
+  * References:
+   + http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1149
+   + http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1
+
+ -- Emanuele Gentili <[e-mail]>  Fri, 14 Mar 2008 19:22:13 +0100
+
 phpmyadmin (4:2.8.0.3-1) unstable; urgency=medium
 
   * New upstream release.

=== added file 'debian/patches/050_CVE-2008-1149.patch'
--- debian/patches/050_CVE-2008-1149.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/050_CVE-2008-1149.patch	2010-04-11 01:26:15 +0000
@@ -0,0 +1,18 @@
+Index: phpMyAdmin-2.8.0.3/libraries/common.lib.php
+===================================================================
+--- phpMyAdmin-2.8.0.3.orig/libraries/common.lib.php	2008-03-14 19:20:54.000000000 +0100
++++ phpMyAdmin-2.8.0.3/libraries/common.lib.php	2008-03-14 19:21:45.000000000 +0100
+@@ -2714,6 +2714,13 @@
+         unset($_POST['redirect']);
+     } // end if (isset($_POST['redirect']))
+     unset($subform_id, $subform);
++} else {
++    // Note: here we overwrite $_REQUEST so that it does not contain cookies,
++    // because another application for the same domain could have set
++    // a cookie (with a compatible path) that overrides a variable 
++    // we expect from GET or POST.
++    // We'll refer to cookies explicitly with the $_COOKIE syntax.
++    $_REQUEST = array_merge($_GET, $_POST);
+ } // end if (isset($_POST['usesubform']))
+ // end check if a subform is submitted
+ 

=== added file 'debian/patches/051_CVE-2009-1151.dpatch'
--- debian/patches/051_CVE-2009-1151.dpatch	1970-01-01 00:00:00 +0000
+++ debian/patches/051_CVE-2009-1151.dpatch	2010-04-11 01:26:15 +0000
@@ -0,0 +1,28 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## From: Artur Rona <[e-mail]>
+## Description: Insufficient output sanitizing when generating configuration file. Do not output unescaped chars to generated configuration file.
+## Bug: https://launchpad.net/bugs/387215
+## Origin: http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev&revision=12301
+## Author: Michal Čihař 
+
+@DPATCH@
+
+diff -pruN -x '*~' phpmyadmin-2.8.0.3.orig/scripts/setup.php phpmyadmin-2.8.0.3/scripts/setup.php
+--- phpmyadmin-2.8.0.3.orig/scripts/setup.php	2006-03-08 20:06:48.000000000 +0100
++++ phpmyadmin-2.8.0.3/scripts/setup.php	2010-04-11 01:53:55.000000000 +0200
+@@ -466,6 +466,7 @@ function get_cfg_string($cfg) {
+         foreach ($c['Servers'] as $cnt => $srv) {
+             $ret .= "\n/* Server " . get_server_name($srv, $cnt) . " */\n\$i++;\n";
+             foreach ($srv as $key => $val) {
++                $key = preg_replace('/[^A-Za-z0-9_]/', '_', $key);
+                 $ret .= get_cfg_val("\$cfg['Servers'][\$i]['$key']", $val);
+             }
+         }
+@@ -474,6 +475,7 @@ function get_cfg_string($cfg) {
+     unset($c['Servers']);
+ 
+     foreach ($c as $key => $val) {
++        $key = preg_replace('/[^A-Za-z0-9_]/', '_', $key);
+         $ret .= get_cfg_val("\$cfg['$key']", $val);
+     }
+ 

=== added file 'debian/patches/series'
--- debian/patches/series	1970-01-01 00:00:00 +0000
+++ debian/patches/series	2010-04-11 01:26:15 +0000
@@ -0,0 +1,2 @@
+050_CVE-2008-1149.patch
+051_CVE-2009-1151