Executive Summary

Summary
Titlephp security update
Informations
NameRHSA-2005:564First vendor Publication2005-07-07
VendorRedHatLast vendor Modification2005-07-07
Severity (Vendor) ImportantRevision01

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score7.5Attack RangeNetwork
Cvss Impact Score6.4Attack ComplexityLow
Cvss Expoit Score10AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated PHP packages that fix two security issues are now available.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Web server.

A bug was discovered in the PEAR XML-RPC Server package included in PHP.
If a PHP script is used which implements an XML-RPC Server using the PEAR
XML-RPC package, then it is possible for a remote attacker to construct an
XML-RPC request which can cause PHP to execute arbitrary PHP commands as
the 'apache' user. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2005-1921 to this issue.

When using the default SELinux "targeted" policy on Red Hat Enterprise
Linux 4, the impact of this issue is reduced since the scripts executed by
PHP are constrained within the httpd_sys_script_t security context.

A race condition in temporary file handling was discovered in the shtool
script installed by PHP. If a third-party PHP module which uses shtool was
compiled as root, a local user may be able to modify arbitrary files.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-1751 to this issue.

Users of PHP should upgrade to these updated packages, which contain
backported fixes for these issues.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

158904 - Incorrect descriptions for php-ncurses and php-gd packages
159000 - CAN-2005-1751 shtool insecure temporary file creation
162044 - CAN-2005-1921 PHP PEAR XML_RPC arbitrary code execution


Original Source

Url : https://rhn.redhat.com/errata/RHSA-2005-564.html

CAPEC : Common Attack Pattern Enumeration & Classification

idName
CAPEC-35Leverage Executable Code in Nonexecutable Files

CWE : Common Weakness Enumeration

idName
CWE-95Improper Sanitization of Directives in Dynamically Evaluated Code ('Eval Injection')

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:9639
 
Oval ID: oval:org.mitre.oval:def:9639
Title: Race condition in shtool 2.0.1 and earlier allows local users to create or modify arbitrary files via a symlink attack on the .shtool.$$ temporary file, a different vulnerability than CVE-2005-1759.
Description: Race condition in shtool 2.0.1 and earlier allows local users to create or modify arbitrary files via a symlink attack on the .shtool.$$ temporary file, a different vulnerability than CVE-2005-1759.
Family: unix Class: vulnerability
Reference(s): CVE-2005-1751
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:345
 
Oval ID: oval:org.mitre.oval:def:345
Title: shtool Race Condition
Description: Race condition in shtool 2.0.1 and earlier allows local users to create or modify arbitrary files via a symlink attack on the .shtool.$$ temporary file, a different vulnerability than CVE-2005-1759.
Family: unix Class: vulnerability
Reference(s): CVE-2005-1751
Version: 1
Platform(s): Red Hat Enterprise Linux 3
Product(s): php
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:350
 
Oval ID: oval:org.mitre.oval:def:350
Title: PEAR XML_RPC PHP Code Execution Vulnerability
Description: Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
Family: unix Class: vulnerability
Reference(s): CVE-2005-1921
Version: 1
Platform(s): Red Hat Enterprise Linux 3
Product(s): php
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11294
 
Oval ID: oval:org.mitre.oval:def:11294
Title: Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
Description: Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
Family: unix Class: vulnerability
Reference(s): CVE-2005-1921
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application17
Application1

OpenVAS Exploits

DateDescription
2009-10-10Name : SLES9: Security update for PHP4
File : nvt/sles9p5021688.nasl
2009-10-10Name : SLES9: Security update for PHP4
File : nvt/sles9p5015816.nasl
2008-09-24Name : Gentoo Security Advisory GLSA 200506-08 (GNU shtool)
File : nvt/glsa_200506_08.nasl
2008-09-24Name : Gentoo Security Advisory GLSA 200507-01 (pear-xml_rpc phpxmlrpc)
File : nvt/glsa_200507_01.nasl
2008-09-24Name : Gentoo Security Advisory GLSA 200507-02 (wordpress)
File : nvt/glsa_200507_02.nasl
2008-09-24Name : Gentoo Security Advisory GLSA 200507-06 (Tikiwiki)
File : nvt/glsa_200507_06.nasl
2008-09-24Name : Gentoo Security Advisory GLSA 200507-07 (phpwebsite)
File : nvt/glsa_200507_07.nasl
2008-09-24Name : Gentoo Security Advisory GLSA 200507-08 (phpgroupware egroupware)
File : nvt/glsa_200507_08.nasl
2008-09-24Name : Gentoo Security Advisory GLSA 200507-15 (PHP)
File : nvt/glsa_200507_15.nasl
2008-09-04Name : FreeBSD Ports: postnuke
File : nvt/freebsd_postnuke1.nasl
2008-09-04Name : FreeBSD Ports: pear-XML_RPC
File : nvt/freebsd_pear-XML_RPC.nasl
2008-09-04Name : FreeBSD Ports: shtool
File : nvt/freebsd_shtool.nasl
2008-09-04Name : FreeBSD Ports: drupal
File : nvt/freebsd_drupal.nasl
2008-01-17Name : Debian Security Advisory DSA 745-1 (drupal)
File : nvt/deb_745_1.nasl
2008-01-17Name : Debian Security Advisory DSA 746-1 (phpgroupware)
File : nvt/deb_746_1.nasl
2008-01-17Name : Debian Security Advisory DSA 747-1 (egroupware)
File : nvt/deb_747_1.nasl
2008-01-17Name : Debian Security Advisory DSA 789-1 (php4)
File : nvt/deb_789_1.nasl
0000-00-00Name : Slackware Advisory SSA:2005-192-01 PHP
File : nvt/esoft_slk_ssa_2005_192_01.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
17793XML-RPC for PHP (PHPXMLRPC) parseRequest() Function Arbitrary PHP Code Execution
16848shtool Symlink Arbitrary File Manipulation

Snort® IPS/IDS

DateDescription
2014-01-10xmlrpc.php post attempt
RuleID : 3827 - Revision : 11 - Type : SERVER-WEBAPP
2014-01-10alternate xmlrpc.php command injection attempt
RuleID : 13818 - Revision : 9 - Type : SERVER-WEBAPP
2014-01-10xmlrpc.php command injection attempt
RuleID : 13817 - Revision : 9 - Type : SERVER-WEBAPP
2014-01-10xmlrpc.php command injection attempt
RuleID : 13816 - Revision : 11 - Type : SERVER-WEBAPP

Metasploit Database

idDescription
2005-06-29 PHP XML-RPC Arbitrary Code Execution

Nessus® Vulnerability Scanner

DateDescription
2006-07-03Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2005-564.nasl - Type : ACT_GATHER_INFO
2006-05-13Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_0274a9f1075911dabc080001020eed82.nasl - Type : ACT_GATHER_INFO
2006-01-15Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-147-1.nasl - Type : ACT_GATHER_INFO
2006-01-15Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-171-1.nasl - Type : ACT_GATHER_INFO
2005-11-11Name : The remote web server contains a PHP script that is prone to arbitrary code e...
File : phpadsnew_xmlrpc.nasl - Type : ACT_ATTACK
2005-10-05Name : The remote host is missing a vendor-supplied security patch
File : suse_SA_2005_049.nasl - Type : ACT_GATHER_INFO
2005-10-05Name : The remote host is missing a vendor-supplied security patch
File : suse_SA_2005_051.nasl - Type : ACT_GATHER_INFO
2005-08-30Name : The remote Debian host is missing a security-related update.
File : debian_DSA-789.nasl - Type : ACT_GATHER_INFO
2005-08-01Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_f241641ef5ea11d9a6db000d608ed240.nasl - Type : ACT_GATHER_INFO
2005-07-20Name : The remote host is missing a vendor-supplied security patch
File : suse_SA_2005_041.nasl - Type : ACT_GATHER_INFO
2005-07-16Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200507-15.nasl - Type : ACT_GATHER_INFO
2005-07-14Name : The remote Debian host is missing a security-related update.
File : debian_DSA-746.nasl - Type : ACT_GATHER_INFO
2005-07-13Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_523fad14eb9d11d9a8bd000cf18bbe54.nasl - Type : ACT_GATHER_INFO
2005-07-13Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2005-192-01.nasl - Type : ACT_GATHER_INFO
2005-07-13Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_6596bb80d02611d99aed000e0c2e438a.nasl - Type : ACT_GATHER_INFO
2005-07-11Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200507-08.nasl - Type : ACT_GATHER_INFO
2005-07-11Name : The remote Debian host is missing a security-related update.
File : debian_DSA-747.nasl - Type : ACT_GATHER_INFO
2005-07-10Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200507-07.nasl - Type : ACT_GATHER_INFO
2005-07-10Name : The remote Debian host is missing a security-related update.
File : debian_DSA-745.nasl - Type : ACT_GATHER_INFO
2005-07-08Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200507-06.nasl - Type : ACT_GATHER_INFO
2005-07-08Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2005-564.nasl - Type : ACT_GATHER_INFO
2005-07-08Name : The remote web server contains a PHP application that is prone to arbitrary P...
File : drupal_xmlrpc.nasl - Type : ACT_ATTACK
2005-07-06Name : The remote Fedora Core host is missing a security update.
File : fedora_2005-517.nasl - Type : ACT_GATHER_INFO
2005-07-06Name : The remote Fedora Core host is missing a security update.
File : fedora_2005-518.nasl - Type : ACT_GATHER_INFO
2005-07-05Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200507-01.nasl - Type : ACT_GATHER_INFO
2005-07-05Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200507-02.nasl - Type : ACT_GATHER_INFO
2005-07-01Name : The remote web server contains a PHP script that is prone to a remote code in...
File : serendipity_xmlrpc_code_injection.nasl - Type : ACT_ATTACK
2005-07-01Name : The remote Mandrake Linux host is missing a security update.
File : mandrake_MDKSA-2005-109.nasl - Type : ACT_GATHER_INFO
2005-06-11Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200506-08.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2014-02-17 11:49:30
  • Multiple Updates