PHPXMLRPC and PEAR XML_RPC Remote Code Injection Vulnerability

BID:14560

Info

PHPXMLRPC and PEAR XML_RPC Remote Code Injection Vulnerability

Bugtraq ID: 14560
Class: Input Validation Error
CVE: CVE-2005-2498
Remote: Yes
Local: No
Published: Aug 15 2005 12:00AM
Updated: Jul 12 2009 05:06PM
Credit: Stefan Esser <[email protected]> is credited with the discovery of this vulnerability.
Vulnerable: Ubuntu Ubuntu Linux 5.0 4 powerpc
Ubuntu Ubuntu Linux 5.0 4 i386
Ubuntu Ubuntu Linux 5.0 4 amd64
Ubuntu Ubuntu Linux 4.1 ppc
Ubuntu Ubuntu Linux 4.1 ia64
Ubuntu Ubuntu Linux 4.1 ia32
TikiWiki Project TikiWiki 1.8.5
TikiWiki Project TikiWiki 1.8.4
+ Gentoo Linux
TikiWiki Project TikiWiki 1.8.3
TikiWiki Project TikiWiki 1.8.2
TikiWiki Project TikiWiki 1.8.1
TikiWiki Project TikiWiki 1.8
TikiWiki Project TikiWiki 1.7.9
TikiWiki Project TikiWiki 1.7.8
TikiWiki Project TikiWiki 1.7.7
TikiWiki Project TikiWiki 1.7.6
TikiWiki Project TikiWiki 1.7.5
TikiWiki Project TikiWiki 1.7.4
TikiWiki Project TikiWiki 1.7.3
TikiWiki Project TikiWiki 1.7.2
TikiWiki Project TikiWiki 1.7.1 .1
TikiWiki Project TikiWiki 1.6.1
SuSE SUSE Linux Enterprise Server 8
+ Linux kernel 2.4.21
+ Linux kernel 2.4.19
SuSE Linux Enterprise Server 9
Slackware Linux 10.1
Slackware Linux 10.0
Slackware Linux 9.1
Slackware Linux 9.0
Slackware Linux 8.1
Slackware Linux -current
SGI ProPack 3.0 SP6
S.u.S.E. Linux Professional 9.3 x86_64
S.u.S.E. Linux Professional 9.3
S.u.S.E. Linux Professional 9.2 x86_64
S.u.S.E. Linux Professional 9.2
S.u.S.E. Linux Professional 9.1 x86_64
S.u.S.E. Linux Professional 9.1
S.u.S.E. Linux Professional 9.0 x86_64
S.u.S.E. Linux Professional 9.0
S.u.S.E. Linux Personal 9.3 x86_64
S.u.S.E. Linux Personal 9.3
S.u.S.E. Linux Personal 9.2 x86_64
S.u.S.E. Linux Personal 9.2
S.u.S.E. Linux Personal 9.1 x86_64
S.u.S.E. Linux Personal 9.1
S.u.S.E. Linux Personal 9.0 x86_64
S.u.S.E. Linux Personal 9.0
Redhat Linux 9.0 i386
Redhat Linux 7.3 i386
Redhat Fedora Core4
Redhat Fedora Core3
Redhat Fedora Core2
Redhat Fedora Core1
Redhat Enterprise Linux WS 4
Redhat Enterprise Linux WS 3
Redhat Enterprise Linux ES 4
Redhat Enterprise Linux ES 3
Redhat Enterprise Linux AS 4
Redhat Enterprise Linux AS 3
Redhat Desktop 4.0
Redhat Desktop 3.0
Redhat Advanced Workstation for the Itanium Processor 2.1
PHPXMLRPC PHPXMLRPC 1.1.1
PhpWiki PhpWIki 1.3.10
phpWebsite phpWebsite 0.10.2
phpWebsite phpWebsite 0.10.1
phpWebsite phpWebsite 0.10
phpWebsite phpWebsite 0.9.3 -4
phpWebsite phpWebsite 0.9.3 -3
phpWebsite phpWebsite 0.9.3 -2
phpWebsite phpWebsite 0.9.3 -1
phpWebsite phpWebsite 0.9.3
phpWebsite phpWebsite 0.8.3
phpWebsite phpWebsite 0.8.2
phpWebsite phpWebsite 0.7.3
phpPgAds phpPgAds 2.0.5
PHPGroupWare PHPGroupWare 0.9.16 RC3
PHPGroupWare PHPGroupWare 0.9.16 RC2
PHPGroupWare PHPGroupWare 0.9.16 RC1
PHPGroupWare PHPGroupWare 0.9.16 .006
PHPGroupWare PHPGroupWare 0.9.16 .005
+ Debian Linux 3.1 sparc
 + Debian Linux 3.1 s/390
 + Debian Linux 3.1 ppc
 + Debian Linux 3.1 mipsel
 + Debian Linux 3.1 mips
 + Debian Linux 3.1 m68k
 + Debian Linux 3.1 ia-64
 + Debian Linux 3.1 ia-32
 + Debian Linux 3.1 hppa
 + Debian Linux 3.1 arm
 + Debian Linux 3.1 alpha
 + Debian Linux 3.1
PHPGroupWare PHPGroupWare 0.9.16 .003
+ Gentoo Linux
PHPGroupWare PHPGroupWare 0.9.16 .002
PHPGroupWare PHPGroupWare 0.9.16 .000
PHPGroupWare PHPGroupWare 0.9.14 .007
PHPGroupWare PHPGroupWare 0.9.14 .006
PHPGroupWare PHPGroupWare 0.9.14 .005
PHPGroupWare PHPGroupWare 0.9.14 .004
PHPGroupWare PHPGroupWare 0.9.14 .003
PHPGroupWare PHPGroupWare 0.9.14 .002
PHPGroupWare PHPGroupWare 0.9.14 .001
PHPGroupWare PHPGroupWare 0.9.14
PHPGroupWare PHPGroupWare 0.9.13
- Debian Linux 2.2
PHPGroupWare PHPGroupWare 0.9.12
- MySQL AB MySQL 3.23.36
- MySQL AB MySQL 3.23.34
- MySQL AB MySQL 3.23.31
- PostgreSQL PostgreSQL 6.5.3
- PostgreSQL PostgreSQL 6.3.2
phpAdsNew phpAdsNew 2.0.4 -pr2
PEAR XML_RPC 1.3.3
Nucleus CMS Nucleus CMS 3.21
Nucleus CMS Nucleus CMS 3.2
Nucleus CMS Nucleus CMS 3.1
Nucleus CMS Nucleus CMS 3.0 RC
Nucleus CMS Nucleus CMS 3.0 1
Nucleus CMS Nucleus CMS 3.0
Mandriva Linux Mandrake 10.2 x86_64
Mandriva Linux Mandrake 10.2
Mandriva Linux Mandrake 10.1 x86_64
Mandriva Linux Mandrake 10.1
Mandriva Linux Mandrake 10.0 AMD64
Mandriva Linux Mandrake 10.0
MandrakeSoft Corporate Server 3.0 x86_64
MandrakeSoft Corporate Server 3.0
MailWatch for MailScanner MailWatch for MailScanner 1.0.1
livesupport livesupport 1.0 rc1
livesupport livesupport 0.9.1
Gentoo Linux
eGroupWare eGroupWare 1.0.6
eGroupWare eGroupWare 1.0.3
eGroupWare eGroupWare 1.0.1
eGroupWare eGroupWare 1.0 .0.007
eGroupWare eGroupWare 1.0
Drupal Drupal 4.6.2
Drupal Drupal 4.6.1
Drupal Drupal 4.6
Drupal Drupal 4.5.4
Drupal Drupal 4.5.3
Drupal Drupal 4.5.2
Drupal Drupal 4.5.1
Drupal Drupal 4.5
Debian Linux 3.0 sparc
Debian Linux 3.0 s/390
Debian Linux 3.0 ppc
Debian Linux 3.0 mipsel
Debian Linux 3.0 mips
Debian Linux 3.0 m68k
Debian Linux 3.0 ia-64
Debian Linux 3.0 ia-32
Debian Linux 3.0 hppa
Debian Linux 3.0 arm
Debian Linux 3.0 alpha
Debian Linux 3.0
b2evolution b2evolution 0.9 .0.12
b2evolution b2evolution 0.9 .0.11
b2evolution b2evolution 0.9 .0.10
b2evolution b2evolution 0.9 .0.09
b2evolution b2evolution 0.9 .0.08
b2evolution b2evolution 0.9 .0.05
b2evolution b2evolution 0.9 .0.03
b2evolution b2evolution 0.8.9
b2evolution b2evolution 0.8.7
b2evolution b2evolution 0.8.6 .2
b2evolution b2evolution 0.8.6 .1
b2evolution b2evolution 0.8.6
b2evolution b2evolution 0.8.2 .2
b2evolution b2evolution 0.8.2
Not Vulnerable: PHPXMLRPC PHPXMLRPC 1.2
phpPgAds phpPgAds 2.0.6
PHPGroupWare PHPGroupWare 0.9.16 .007
phpAdsNew phpAdsNew 2.0.6
PEAR XML_RPC 1.4
Nucleus CMS Nucleus CMS 3.22
Nucleus CMS Nucleus CMS 3.21
MailWatch for MailScanner MailWatch for MailScanner 1.0.2
livesupport livesupport 1.0 rc2
eGroupWare eGroupWare 1.0 .0.009
Drupal Drupal 4.6.3
Drupal Drupal 4.5.5
b2evolution b2evolution 0.9.1

Discussion

PHPXMLRPC and PEAR XML_RPC Remote Code Injection Vulnerability

PHPXMLRPC and PEAR XML_RPC are affected by a remote PHP code injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

Exploit / POC

PHPXMLRPC and PEAR XML_RPC Remote Code Injection Vulnerability

No exploit is required.

Solution / Fix

PHPXMLRPC and PEAR XML_RPC Remote Code Injection Vulnerability

Solution:
The vendor has released version 1.2 of PHPXMLRPC and version 1.4 of PEAR XML_RPC to correct this problem.

Nucleus CMS has released a patch addressing this issue. Reports indicate an upgrade will be available shortly. Please contact the vendor for further information.

eGroupWare has addressed this issue in version 1.0.0.009.

phpPgAds and phpAdsNew have released patches addressing this issue.

Mailwatch for MailScanner has released a patch addressing this issue.

LiveSupport has released an update addressing this issue.

Ubuntu Linux has released security advisory USN-171-1 addressing this and other issues. Please see the referenced advisory for details on obtaining and applying the appropriate updates.

RedHat has released advisory RHSA-2005:748-05, along with fixes to address this issue in PHP4 for RedHat Enterprise Linux operating systems. Please see the referenced advisory for further information.

Mandriva has released advisory MDKSA-2005:146, along with fixes to address this issue in php-pear. Please see the referenced advisory for further information.

Gentoo Linux has released advisory GLSA 200508-13 to address this issue in PEAR-XML_RPC and phpxmlrpc. Users of affected packages are urged to execute the following commands with superuser privileges:

PEAR-XML_RPC users:
emerge --sync
emerge --ask --oneshot --verbose ">=dev-php/PEAR-XML_RPC-1.4.0"

phpxmlrpc users:
emerge --sync
emerge --ask --oneshot --verbose ">=dev-php/phpxmlrpc-1.2-r1"

Please see the referenced advisory for further information.

Gentoo Linux has released advisory GLSA 200508-14 to address this issue in eGroupWare and TikiWiki. Users of affected packages are urged to execute the following commands with superuser privileges:

TikiWiki users:
emerge --sync
emerge --ask --oneshot --verbose ">=www-apps/tikiwiki-1.8.5-r2"

eGroupWare users:
emerge --sync
emerge --ask --oneshot --verbose ">=www-apps/egroupware-1.0.0.009"

Gentoo Linux has released advisory GLSA 200508-18 to address this issue in PhpWiki. Users of affected packages are urged to execute the following commands with superuser privileges:
emerge --sync
emerge --ask --oneshot --verbose ">=www-apps/phpwiki-1.3.10-r2"
Please see the referenced advisory for further information.

Fedora has released advisories FEDORA-2005-809 and FEDORA-2005-810 containing an upstream version of the PEAR XML_RPC package to address this issue in Fedora Core 3 and Fedora Core 4. Please see the referenced advisories for more information.

Debian has released advisory DSA 789-1 to address various issues. Please see the referenced advisory for more information.

SUSE has released advisory SUSE-SA:2005:049 to address this and other issues affecting PHP. Please see the referenced advisory for more information.

Gentoo Linux has released security advisory GLSA 200508-20 addressing this issue. Gentoo recommends all phpGroupWare users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/phpgroupware-0.9.16.008"

SUSE has reported that some fixes included in the advisory SUSE-SA:2005:049 for SUSE Linux Enterprise Server 9, SUSE Linux 9.0, 9.1, 9.2 and 9.3 have been removed due to the introduction of new bugs. SUSE plans to release a new advisory containing updated fixes in the near future.

Gentoo Linux has released security advisory GLSA 200508-21 addressing this issue. Gentoo recommends all phpWebSite users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/phpwebsite-0.10.2_rc2"

Slackware Linux has released advisory SSA:2005-242-02 to address this issue. Please see the referenced advisory for more information.

Debian has released advisory DSA 798-1 to address this and other issues in phpgroupware. Please see the referenced advisory for more information.

SuSE has released advisory SUSE-SA:2005:051 to address this and other issues. Please see the referenced advisory for links to fixes.

SGI has released Security Update #46 to address this and other issues for SGI Propack 3 Service Pack 6. Please see the referenced advisory for further information.

Slackware has released security advisory SSA:2005-251-04 addressing this issue. Please see the referenced advisory for details on obtaining and applying the appropriate updates.

Gentoo has released security advisory GLSA 200509-19 addressing this issue. Gentoo recommends the following:
All PHP users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose dev-php/php

All mod_php users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose dev-php/mod_php

All php-cgi users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose dev-php/php-cgi

Debian Linux has released security advisory DSA 840-1 addressing this issue for Drupal. Please see the referenced advisory for more information.

Debian Linux has released security advisory DSA 842-1 addressing this issue for eGroupware. Please see the referenced advisory for more information.

Conectiva Linux has released security advisory CLSA-2005:1024 addressing this issue. Please see the referenced advisory for details on obtaining and applying the appropriate updates.

b2evolution has addressed this issue in version 0.9.1.

Fedora Legacy advisory FLSA:166943 is available to address various issues affecting PHP in Red Hat Linux 7.3, Red Hat Linux 9, Fedora Core 1, and Fedora Core 2. Please see the referenced advisory for more information.


Redhat Fedora Core3

b2evolution b2evolution 0.8.2 .2

b2evolution b2evolution 0.8.6

b2evolution b2evolution 0.8.6 .1

b2evolution b2evolution 0.8.7

b2evolution b2evolution 0.9 .0.12

b2evolution b2evolution 0.9 .0.03

b2evolution b2evolution 0.9 .0.10

b2evolution b2evolution 0.9 .0.11

PHPGroupWare PHPGroupWare 0.9.12

PHPGroupWare PHPGroupWare 0.9.13

PHPGroupWare PHPGroupWare 0.9.14

PHPGroupWare PHPGroupWare 0.9.14 .002

PHPGroupWare PHPGroupWare 0.9.14 .007

PHPGroupWare PHPGroupWare 0.9.16 RC3

PHPGroupWare PHPGroupWare 0.9.16 .003

PHPGroupWare PHPGroupWare 0.9.16 .000

PHPGroupWare PHPGroupWare 0.9.16 .006

PHPGroupWare PHPGroupWare 0.9.16 .005

eGroupWare eGroupWare 1.0.1

eGroupWare eGroupWare 1.0.3

eGroupWare eGroupWare 1.0.6

PHPXMLRPC PHPXMLRPC 1.1.1

PEAR XML_RPC 1.3.3

phpAdsNew phpAdsNew 2.0.4 -pr2

SGI ProPack 3.0 SP6

Nucleus CMS Nucleus CMS 3.1

Nucleus CMS Nucleus CMS 3.21

Drupal Drupal 4.5

Drupal Drupal 4.5.1

Drupal Drupal 4.6

Drupal Drupal 4.6.1

Drupal Drupal 4.6.2

References

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report