Brief items
A serious vulnerability in the PEAR
XML_RPC library and the
XML-RPC for PHP package has been
disclosed. The vulnerability allows unsanitized data to be passed to the
eval() call, which would allow execution of arbitrary PHP code.
The vulnerability was reported by James Bercegay of the GulfTech Security Research Team. Bercegay reports that the parseRequest() function passes data to eval() without sanitizing the input first. As a result, a properly-crafted XML file can be used to execute PHP code on the targeted server. Bercegay's advisory gives an example that could be used to execute the relatively harmless phpinfo() function to be executed on a target server:
<?xml version="1.0"?>
<methodCall>
<methodName>test.method</methodName>
<params>
<param>
<value><name>','')); phpinfo(); exit;/*</name></value>
</param>
</params>
</methodCall>
PEAR's library or the XML-RPC for PHP package are used in a number of PHP-based projects, including WordPress, Drupal, PostNuke, Xaraya, phpGroupWare, Tikiwiki, and many others, which means that there are a lot of vulnerable servers out there. Users of PHP-based blogging applications and other packages that use XML_RPC should check to see if the software is vulnerable and update the package as soon as a new release is available. Some projects, like PostNuke, are advising users to remove the offending code altogether.
PEAR's XML_RPC library is also distributed with many Linux distributions. Most of the vulnerable projects and distributions have announced updated packages, and the PHP project has bundled the new PEAR XML_RPC package in PHP 4.4.0RC2, and a separate release is available on the PEAR site. The final PHP 4.4.0 release is scheduled for July 11. Users can also update the PEAR library by running "pear upgrade XML_RPC" as root or using sudo. An update of XML-RPC for PHP is also available.
Users should upgrade or take steps to remove the library as soon as possible, as it seems likely that exploits of this vulnerability will begin appearing in the wild soon, if they have not already.
Comments (2 posted)
New vulnerabilities
crip: insecure temporary files
| Package(s): | crip |
CVE #(s): | CAN-2005-0393
|
| Created: | June 30, 2005 |
Updated: | July 6, 2005 |
| Description: |
Justin Rye discovered that crip, a terminal-based ripper, encoder and
tagger tool, utilizes temporary files in an insecure fashion in its
helper scripts. |
| Alerts: |
|
Comments (none posted)
kernel: multiple vulnerabilities
| Package(s): | kernel |
CVE #(s): | CAN-2005-1913
CAN-2005-1761
|
| Created: | July 1, 2005 |
Updated: | September 9, 2005 |
| Description: |
Several vulnerabilities in the 2.6 kernel have been
fixed, including a subthread exec problem (CAN-2005-1913)
and a ia64 ptrace + sigrestore_context problem (CAN-2005-1761). |
| Alerts: |
|
Comments (1 posted)
phpbb: arbitrary command execution
| Package(s): | phpbb |
CVE #(s): | |
| Created: | July 4, 2005 |
Updated: | July 6, 2005 |
| Description: |
Ron van Daal discovered a vulnerability in the PhpBB
highlighting code that can allow an attacker to
execute arbitrary code with the privileges of the web server. |
| Alerts: |
|
Comments (none posted)
php-pear: remote code execution
| Package(s): | php-pear |
CVE #(s): | CAN-2005-1921
|
| Created: | July 1, 2005 |
Updated: | July 29, 2005 |
| Description: |
The PEAR XMLRPC implementation has a vulnerability that can
be exploited for remote code execution. See this report from GulfTech Security Research. This vulnerability affects a large number of PHP web applications.
|
| Alerts: |
|
Comments (none posted)
zlib: buffer overflow
| Package(s): | zlib |
CVE #(s): | CAN-2005-2096
|
| Created: | July 6, 2005 |
Updated: | October 27, 2005 |
| Description: |
zlib has a buffer overflow vulnerability that can be exploited
by inflation of corrupted files, this can be used to crash zlib
or possibly remotely execute code. |
| Alerts: |
|
Comments (6 posted)
Resources
The Linux Advisory Watch for July 1, 2005 is out, with articles on Linux
File & Directory Permissions Mistakes, Measuring Security IT Success,
Getting to Know Linux Security: File Permissions, The Tao of Network
Security Monitoring: Beyond Intrusion Detection, and other news.
Full Story (comments: none)
The Linux Advisory Watch for July 4, 2005 is out. Articles include Review:
The Book of Postfix: State-of-the-Art Message Transport, Introduction:
Buffer Overflow Vulnerabilities, Getting to Know Linux Security: File
Permissions, and more.
Full Story (comments: none)
Page editor: Rebecca Sobol
Next page:
Kernel development>>