| Description: | Description:
The remote host is missing an update to php-pear
announced via advisory MDKSA-2005:109.
A vulnerability was discovered by GulfTech Security in the PHP XML RPC
project. This vulnerability is considered critical and can lead to
remote code execution. The vulnerability also exists in the PEAR
XMLRPC implementation.
Mandriva ships with the PEAR XMLRPC implementation and it has been
patched to correct this problem. It is advised that users examine the
PHP applications they have installed on their servers for any
applications that may come bundled with their own copies of the PEAR
system and either patch RPC.php or use the system PEAR (found in
/usr/share/pear).
Updates have been released for some popular PHP applications such
as WordPress and Serendipity and users are urged to take all
precautions to protect their systems from attack and/or defacement by
upgrading their applications from the authors of the respective
applications.
Affected versions: 10.0, 10.1, 10.2, Corporate 3.0
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2005:109
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1921
http://www.hardened-php.net/advisory-022005.php
Risk factor : High
CVSS Score:
7.5
|
