Main Security Downloads Forum Free e-books Security Advisories Vulnerabilities IT News Virus Central Services Advertise Newsletter Shop Search Wap-PDA/mobile Other Affiliates Contact RSS feeds

Vendor: Gentoo Vendor ID: GLSA 200508-18 Title: PhpWiki arbitrary command execution Publishing date: August 26, 2005 Published by: Nikola Strahija Other advisories by Gentoo: Wireshark dissectors vulnerabilities GIMP buffer overflow bug Xine-lib buffer overflow Libpng buffer overflow bug SHOUTcast server multiple vulnerabilities     Printable version  |    Send to a friend   Security Advisory info: PhpWiki includes PHP XML-RPC code which is vulnerable to arbitrary command execution. A remote attacker could exploit this vulnerability to inject arbitrary PHP script code into eval() statements by sending a specially crafted XML document to PhpWiki. Scroll down to see the full advisory - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200508-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: PhpWiki: Arbitrary command execution through XML-RPC Date: August 26, 2005 Bugs: #102380 ID: 200508-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== PhpWiki includes PHP XML-RPC code which is vulnerable to arbitrary command execution. Background ========== PhpWiki is an application that creates a web site where anyone can edit the pages through HTML forms. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-apps/phpwiki < 1.3.10-r2 >= 1.3.10-r2 Description =========== Earlier versions of PhpWiki contain an XML-RPC library that improperly handles XML-RPC requests and responses with malformed nested tags. Impact ====== A remote attacker could exploit this vulnerability to inject arbitrary PHP script code into eval() statements by sending a specially crafted XML document to PhpWiki. Workaround ========== There is no known workaround at this time. Resolution ========== All PhpWiki users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/phpwiki-1.3.10-r2" References ========== [ 1 ] CAN-2005-2498 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2498 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200508-18.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2005 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.0     Printable version  |    Send to a friend

	Our Services			Information			Our Online Shop			Community Forum Topics
	Free weekly Newsletter Advertise on Xatrix Monthly News Archive Community Forum			Impressum/about Contributing Newsletter archive Latest bugs			Top sellers New Items Books Software			RMC3IENGINE - VMWar... VMWare CC3 Server -... C2k Commissioning CDs On Sale New Apple i...
Our Privacy Policy | Contact Us Powered by TiP / Rapid IT | HITB.org All content on this website is property of Xatrix Security if not noted otherwise. Copyright 2000 - 2010 Xatrix Security