full-disclosure - Re: FD-V5-I5 [ GLSA 200507-01 ] PEAR XML-RPC, phpxmlrpc: PHP script injection vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <42CA700F.4020203@wefixtech.co.uk>
Date: Tue Jul  5 12:33:54 2005
From: tony at wefixtech.co.uk (Tony Dodd)
Subject: Re: FD-V5-I5 [ GLSA 200507-01 ] PEAR XML-RPC,
 phpxmlrpc: PHP script injection vulnerability

<snip>
> 
> Synopsis
> ========
> 
> The PEAR XML-RPC and phpxmlrpc libraries allow remote attackers to
> execute arbitrary PHP script commands.
> 
<snip>
> 
> Impact
> ======
> 
> A remote attacker could exploit this vulnerability to execute arbitrary
> PHP script code by sending a specially crafted XML document to web
> applications making use of these libraries.
> 
> Workaround
> ==========
> 
> There are no known workarounds at this time.
> 
> Resolution
> ==========
> 
> All PEAR-XML_RPC users should upgrade to the latest available version:
> 
>     # emerge --sync
>     # emerge --ask --oneshot --verbose ">=dev-php/PEAR-XML_RPC-1.3.1"
> 
> All phpxmlrpc users should upgrade to the latest available version:
> 
>     # emerge --sync
>     # emerge --ask --oneshot --verbose ">=dev-php/phpxmlrpc-1.1.1"
<snip>

Considering this is such a widespread issue - pretty much up to the same 
level as santy was -, it bothers me that there has been so little 
discussion.  This is going to effect the majority of the hosting 
industry; many php based web programs utilize the now opensource 
phpxmlrpc; which leaves a lot of stuff open to exploitation.

Add to that the fact that the exploits are available already, and the 
majority of people I've spoken to so far/forum posts I've read etc don't 
know how to deal with this.

There is talk from some people that simply upgrading phpxmlrpc will not 
suffice, and that you have to upgrade everything which uses it. 
Confusion abundant so to speak.

Anyone have any clarification on this?

Regards,

Tony Dodd