[SA16255] MySQL Eventum PEAR XML_RPC PHP Code Execution Vulnerability

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

FreeBSD : pear-XML_RPC -- arbitrary remote code execution (523fad14-eb9d-11d9-a8bd-000cf18bbe54)

GulfTech Security Research Team reports : PEAR XMLRPC is vulnerable to a very high risk php code injection vulnerability due to unsanatized data being passed into an eval call. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extract...

Slackware 10.0 / 10.1 / 8.1 / 9.0 / 9.1 / current : PHP (SSA:2005-192-01)

New PHP packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, and -current to fix a security issue with the PEAR XMLRPC class that allows a remote attacker to run arbitrary PHP code. Sites that make use of this PHP library should upgrade to the new PHP package right away, or may instead...

FreeBSD : pear-XML_RPC -- information disclosure vulnerabilities (b64481d9-eff4-11d9-8310-0001020eed82)

The pear-XMLRPC release notes reports that the following issues has been fixed : Eliminate path disclosure vulnerabilities by suppressing error messages when eval'ing. Eliminate path disclosure vulnerability by catching bogus parameters submitted to XMLRPCValue::serializeval. %NASLMINLEVEL 70300 ...

PHP

New PHP packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, and -current to fix a security issue with the PEAR XMLRPC class that allows a remote attacker to run arbitrary PHP code. Sites that make use of this PHP library should upgrade to the new PHP package right away, or may instead...

pear-XML_RPC -- information disclosure vulnerabilities

The pear-XMLRPC release notes reports that the following issues has been fixed: Eliminate path disclosure vulnerabilities by suppressing error messages when eval'ing. Eliminate path disclosure vulnerability by catching bogus parameters submitted to XMLRPCValue::serializeval...

Fedora Core 3 : php-4.3.11-2.6 (2005-517)

This update includes the PEAR XMLRPC 1.3.1 package, which fixes a security issue in the XMLRPC server implementation. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the name CVE-2005-1921 to this issue. The bundled version of shtool is also updated, to fix some...

Fedora Core 4 : php-5.0.4-10.3 (2005-518)

This update includes the PEAR XMLRPC 1.3.1 package, which fixes a security issue in the XMLRPC server implementation. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the name CVE-2005-1921 to this issue. The bundled version of shtool is also updated, to fix some...

CVE-2005-1921

Eval injection vulnerability in PEAR XMLRPC 1.3.0 and earlier aka XML-RPC or xmlrpc and PHPXMLRPC aka XML-RPC For PHP or php-xmlrpc 1.1 and earlier, as used in products such as 1 WordPress, 2 Serendipity, 3 Drupal, 4 egroupware, 5 MailWatch, 6 TikiWiki, 7 phpWebSite, 8 Ampache, and others, allows...

XML-RPC Library 1.3.0 - xmlrpc.php Remote Command Execution (3)

XML-RPC Library 1.3.0 - xmlrpc.php Remote Command Execution 3 !/usr/bin/perl -w XML-RPC Remote Command Execution Exploit By Mike Rifone This works on da phpxmlrpc, and da PEAR XMLRPC too! All you need is to put the url to the server and u get shell Dis is my first exploit but hey it works :D...

XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Command Execution (3)

!/usr/bin/perl -w XML-RPC Remote Command Execution Exploit By Mike Rifone This works on da phpxmlrpc, and da PEAR XMLRPC too! All you need is to put the url to the server and u get shell Dis is my first exploit but hey it works :D Mike@Rifone use LWP::UserAgent; $brws = new LWP::UserAgent;...

CVE-2005-1921

Eval injection vulnerability in PEAR XMLRPC 1.3.0 and earlier aka XML-RPC or xmlrpc and PHPXMLRPC aka XML-RPC For PHP or php-xmlrpc 1.1 and earlier, as used in products such as 1 WordPress, 2 Serendipity, 3 Drupal, 4 egroupware, 5 MailWatch, 6 TikiWiki, 7 phpWebSite, 8 Ampache, and others, allows...

PEAR XML_RPC Remote Code Execution Vulnerability

GulfTech Security Research June 29th, 2005 Vendor : The PEAR Group URL : http://pear.php.net/package/XMLRPC/ Version : PEAR XMLRPC 1.3.0 && Earlier Risk : Remote Command Execution Description: PEAR XMLRPC is a PHP implementation of the XML-RPC web RPC protocol, and used by many different develope...

pear130.txt

GulfTech Security Research June 29th, 2005 Vendor : The PEAR Group URL : http://pear.php.net/package/XMLRPC/ Version : PEAR XMLRPC 1.3.0 && Earlier Risk : Remote Command Execution Description: PEAR XMLRPC is a PHP implementation of the XML-RPC web RPC protocol, and used by many different develope...

Advisory 02/2005: Remote code execution in Serendipity

Hardened PHP Project www.hardened-php.net -= Security Advisory =- Advisory: Remote code execution in Serendipity Release Date: 2005/06/29 Last Modified: 2005/06/29 Author: Christopher Kunz [email protected] Application: Serendipity = 0.8.2 Severity: Arbitrary remote code execution...

pear-XML_RPC -- arbitrary remote code execution

GulfTech Security Research Team reports: PEAR XMLRPC is vulnerable to a very high risk php code injection vulnerability due to unsanatized data being passed into an eval call...

XML-RPC for PHP Remote Code Injection Vulnerability

Description XML-RPC for PHP is affected by a remote code-injection vulnerability. An attacker may exploit this issue to execute arbitrary commands or code in the context of the webserver. This may facilitate various attacks, including unauthorized remote access. XML-RPC for PHP 1.1 and prior...

WordPress <= 1.3.0 - Eval Injection

Because of this vulnerability in PEAR XMLRPC, attackers can execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement. Solution Update the WordPress to the latest available version at least 1.4...