Executive Summary
| Summary | |
|---|---|
| Title | php security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2005:748 | First vendor Publication | 2005-08-19 |
| Vendor | RedHat | Last vendor Modification | 2005-08-19 |
| Severity (Vendor) | Important | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated PHP packages that fix a security issue are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. A bug was discovered in the PEAR XML-RPC Server package included in PHP. If a PHP script is used which implements an XML-RPC Server using the PEAR XML-RPC package, then it is possible for a remote attacker to construct an XML-RPC request which can cause PHP to execute arbitrary PHP commands as the 'apache' user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-2498 to this issue. When using the default SELinux "targeted" policy on Red Hat Enterprise Linux 4, the impact of this issue is reduced since the scripts executed by PHP are constrained within the httpd_sys_script_t security context. Users of PHP should upgrade to these updated packages, which contain backported fixes for these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 165846 - CAN-2005-2498 PHP PEAR:XMLRPC eval code injection |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2005-748.html |
CAPEC : Common Attack Pattern Enumeration & Classification
| Id | Name |
|---|---|
| CAPEC-35 | Leverage Executable Code in Nonexecutable Files |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:9569 | |||
| Oval ID: | oval:org.mitre.oval:def:9569 | ||
| Title: | Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921. | ||
| Description: | Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-2498 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Os | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for PHP4 File : nvt/sles9p5021688.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200508-13 (pear-xml_rpc phpxmlrpc) File : nvt/glsa_200508_13.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200508-14 (tikiwiki egroupware) File : nvt/glsa_200508_14.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200508-18 (phpwiki) File : nvt/glsa_200508_18.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200508-20 (phpgroupware) File : nvt/glsa_200508_20.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200508-21 (phpwebsite) File : nvt/glsa_200508_21.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200509-19 (PHP) File : nvt/glsa_200509_19.nasl |
| 2008-09-04 | Name : FreeBSD Ports: pear-XML_RPC File : nvt/freebsd_pear-XML_RPC1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 789-1 (php4) File : nvt/deb_789_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 798-1 (phpgroupware) File : nvt/deb_798_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 840-1 (drupal) File : nvt/deb_840_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 842-1 (egroupware) File : nvt/deb_842_1.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2005-242-02 PHP File : nvt/esoft_slk_ssa_2005_242_02.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2005-251-04 php5 in Slackware 10.1 File : nvt/esoft_slk_ssa_2005_251_04.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 18889 | XML-RPC for PHP (PHPXMLRPC) Nested XML Tags Arbitrary PHP Code Execution XML-RPC for PHP (PHPXMLRPC) contains a flaw that may allow a remote attacker to execute arbitrary PHP code. The problem is that the library does not properly sanitizing certain XML tags that are nested in a parsed PHP document before being used in an 'eval()' call, which may allow a remote attacker to execute arbitrary PHP code resulting in a loss of integrity. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2006-07-05 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2005-748.nasl - Type : ACT_GATHER_INFO |
| 2006-05-13 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_e65ad1bf0d8b11da90d000304823c0d3.nasl - Type : ACT_GATHER_INFO |
| 2006-01-15 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-171-1.nasl - Type : ACT_GATHER_INFO |
| 2005-10-05 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2005-251-04.nasl - Type : ACT_GATHER_INFO |
| 2005-10-05 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2005_051.nasl - Type : ACT_GATHER_INFO |
| 2005-10-05 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2005_049.nasl - Type : ACT_GATHER_INFO |
| 2005-10-05 | Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2005-146.nasl - Type : ACT_GATHER_INFO |
| 2005-10-05 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200509-19.nasl - Type : ACT_GATHER_INFO |
| 2005-10-05 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-842.nasl - Type : ACT_GATHER_INFO |
| 2005-10-05 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-840.nasl - Type : ACT_GATHER_INFO |
| 2005-10-05 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2005-242-02.nasl - Type : ACT_GATHER_INFO |
| 2005-09-12 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-810.nasl - Type : ACT_GATHER_INFO |
| 2005-09-12 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-809.nasl - Type : ACT_GATHER_INFO |
| 2005-09-06 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200508-20.nasl - Type : ACT_GATHER_INFO |
| 2005-09-06 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200508-21.nasl - Type : ACT_GATHER_INFO |
| 2005-09-06 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-798.nasl - Type : ACT_GATHER_INFO |
| 2005-08-30 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200508-13.nasl - Type : ACT_GATHER_INFO |
| 2005-08-30 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200508-14.nasl - Type : ACT_GATHER_INFO |
| 2005-08-30 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200508-18.nasl - Type : ACT_GATHER_INFO |
| 2005-08-30 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-789.nasl - Type : ACT_GATHER_INFO |
| 2005-08-29 | Name : The remote web server contains a PHP application that is affected by multiple... File : phpadsnew_206.nasl - Type : ACT_ATTACK |
| 2005-08-23 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-748.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:49:37 |
|
