drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebigen Codes in php-pear
Name: |
Ausführen beliebigen Codes in php-pear
|
|
ID: |
SSA:2005-192-01 |
|
Distribution: |
Slackware |
|
Plattformen: |
Slackware -current, Slackware 8.1, Slackware 9.0, Slackware 9.1, Slackware 10.0, Slackware 10.1 |
|
Datum: |
Mo, 11. Juli 2005, 13:00 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1921 |
|
Applikationen: |
PHP |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
[slackware-security] PHP (SSA:2005-192-01)
New PHP packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, and -current to fix a security issue with the PEAR XML_RPC class that allows a remote attacker to run arbitrary PHP code. Sites that make use of this PHP library should upgrade to the new PHP package right away, or may instead upgrade the XML_RPC PEAR class with the following command:
pear upgrade XML_RPC
More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1921
Here are the details from the Slackware 10.1 ChangeLog: +--------------------------+ patches/packages/php-4.3.11-i486-2.tgz: Upgraded PEAR XML_RPC class. This new PHP package fixes a PEAR XML_RPC vulnerability. Sites that use this PEAR class should upgrade to the new PHP package, or as a minimal fix may instead upgrade the XML_RPC PEAR class with the following command: pear upgrade XML_RPC (* Security fix *) +--------------------------+
Where to find the new packages: +-----------------------------+
Updated package for Slackware 8.1: php-4.3.11-i386-2.tgz
Updated package for Slackware 9.0: php-4.3.11-i386-2.tgz
Updated package for Slackware 9.1: php-4.3.11-i486-2.tgz
Updated package for Slackware 10.0: php-4.3.11-i486-2.tgz
Updated package for Slackware 10.1: php-4.3.11-i486-2.tgz
Updated package for Slackware -current: php-4.4.0-i486-1.tgz
MD5 signatures: +-------------+
Slackware 8.1 package: b968e86e7876d52f83453f45f6dd844f php-4.3.11-i386-2.tgz
Slackware 9.0 package: 639ce88dea73156c70f5e011d96c2785 php-4.3.11-i386-2.tgz
Slackware 9.1 package: b5a8235ca226d0420ade16770ac1c24f php-4.3.11-i486-2.tgz
Slackware 10.0 package: 4aef14c01c4c574b83f4867a8ac58cac php-4.3.11-i486-2.tgz
Slackware 10.1 package: 7ff0731532e3bd24698c90f0f803db49 php-4.3.11-i486-2.tgz
Slackware -current package: 66702eabe070fa223a2c888c467afa53 php-4.4.0-i486-1.tgz
Installation instructions: +------------------------+
First, stop apache: # apachectl stop
Next, upgrade to the new PHP package: # upgradepkg php-4.3.11-i486-2.tgz
Finally, restart apache: # apachectl start (or: apachectl startssl)
+-----+
Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com
+------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. | +------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.7 (GNU/Linux)
iD8DBQFC0vLxakRjwEAQIjMRAlriAJ9qY31uY5kDC0G1Rw32/7HPQAOPKACfYt7Y K22XHeNLwSicdmpDc+JDnSA= =spLu -----END PGP SIGNATURE-----
|
|
|
|