PHP PEAR Go-Pear.PHP Arbitrary Remote Code Execution Vulnerability

Bugtraq ID:	16174
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 09 2006 12:00AM
Updated:	Jan 09 2006 12:00AM
Credit:	Gammarays is credited with the discovery of this vulnerability.
Vulnerable:	Nortel Networks Universal Signaling Point Compact/Lite 0.2.2
Not Vulnerable:

PHP PEAR Go-Pear.PHP Arbitrary Remote Code Execution Vulnerability

go-pear.php is prone to a vulnerability that could permit the execution of arbitrary code.

Successful exploitation will facilitate a remote compromise of the affected computer.

This issue is reported to affect version 0.2.2; other versions may also be vulnerable.

PHP PEAR Go-Pear.PHP Arbitrary Remote Code Execution Vulnerability

No exploit is required.

PHP PEAR Go-Pear.PHP Arbitrary Remote Code Execution Vulnerability

Solution:
Reports indicate an update is available to address this issue; this has not been confirmed by Symantec. Users are advised to contact the vendor for further information.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PHP PEAR Go-Pear.PHP Arbitrary Remote Code Execution Vulnerability

References:

• Apache2Triad Homepage (Apache2Triad)
  
• go-pear.php (go-pear.org)
  
• PEAR Home Page (PEAR)