Mandrake Linux Security Advisory : php-pear (MDKSA-2005:109)

This script is Copyright (C) 2005-2013 Tenable Network Security, Inc.


Synopsis :

The remote Mandrake Linux host is missing a security update.

Description :

A vulnerability was discovered by GulfTech Security in the PHP XML RPC
project. This vulnerability is considered critical and can lead to
remote code execution. The vulnerability also exists in the PEAR
XMLRPC implementation.

Mandriva ships with the PEAR XMLRPC implementation and it has been
patched to correct this problem. It is advised that users examine the
PHP applications they have installed on their servers for any
applications that may come bundled with their own copies of the PEAR
system and either patch RPC.php or use the system PEAR (found in
/usr/share/pear).

Updates have been released for some popular PHP applications such as
WordPress and Serendipity and users are urged to take all precautions
to protect their systems from attack and/or defacement by upgrading
their applications from the authors of the respective applications.

See also :

http://www.hardened-php.net/advisory-022005.php

Solution :

Update the affected php-pear package.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
Public Exploit Available : true

Family: Mandriva Local Security Checks

Nessus Plugin ID: 18597 (mandrake_MDKSA-2005-109.nasl)

Bugtraq ID:

CVE ID: CVE-2005-1921

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now