Ausführen beliebigen Codes in php-pear
ID: | SSA:2005-192-01 |
Distribution: | Slackware |
Plattformen: | Slackware -current, Slackware 8.1, Slackware 9.0, Slackware 9.1, Slackware 10.0, Slackware 10.1 |
Datum: | Mo, 11. Juli 2005, 13:00 |
Referenzen: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1921 |
Applikationen: | PHP |
Originalnachricht |
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] PHP (SSA:2005-192-01) New PHP packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, and -current to fix a security issue with the PEAR XML_RPC class that allows a remote attacker to run arbitrary PHP code. Sites that make use of this PHP library should upgrade to the new PHP package right away, or may instead upgrade the XML_RPC PEAR class with the following command: pear upgrade XML_RPC More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1921 Here are the details from the Slackware 10.1 ChangeLog: +--------------------------+ patches/packages/php-4.3.11-i486-2.tgz: Upgraded PEAR XML_RPC class. This new PHP package fixes a PEAR XML_RPC vulnerability. Sites that use this PEAR class should upgrade to the new PHP package, or as a minimal fix may instead upgrade the XML_RPC PEAR class with the following command: pear upgrade XML_RPC (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Updated package for Slackware 8.1: ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/php-4.3.11-i386-2.tgz Updated package for Slackware 9.0: ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/php-4.3.11-i386-2.tgz Updated package for Slackware 9.1: ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/php-4.3.11-i486-2.tgz Updated package for Slackware 10.0: ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/php-4.3.11-i486-2.tgz Updated package for Slackware 10.1: ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/php-4.3.11-i486-2.tgz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/php-4.4.0-i486-1.tgz MD5 signatures: +-------------+ Slackware 8.1 package: b968e86e7876d52f83453f45f6dd844f php-4.3.11-i386-2.tgz Slackware 9.0 package: 639ce88dea73156c70f5e011d96c2785 php-4.3.11-i386-2.tgz Slackware 9.1 package: b5a8235ca226d0420ade16770ac1c24f php-4.3.11-i486-2.tgz Slackware 10.0 package: 4aef14c01c4c574b83f4867a8ac58cac php-4.3.11-i486-2.tgz Slackware 10.1 package: 7ff0731532e3bd24698c90f0f803db49 php-4.3.11-i486-2.tgz Slackware -current package: 66702eabe070fa223a2c888c467afa53 php-4.4.0-i486-1.tgz Installation instructions: +------------------------+ First, stop apache: # apachectl stop Next, upgrade to the new PHP package: # upgradepkg php-4.3.11-i486-2.tgz Finally, restart apache: # apachectl start (or: apachectl startssl) +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com +------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. | +------------------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.7 (GNU/Linux) iD8DBQFC0vLxakRjwEAQIjMRAlriAJ9qY31uY5kDC0G1Rw32/7HPQAOPKACfYt7Y K22XHeNLwSicdmpDc+JDnSA= =spLu -----END PGP SIGNATURE----- |