Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921.

Updated PHP packages that fix a security issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A bug was discovered in the PEAR XML-RPC Server package included in PHP. If a PHP script is used which implements an XML-RPC Server using the PEAR XML-RPC package, then it is possible for a remote attacker to construct an XML-RPC request which can cause PHP to execute arbitrary PHP commands as the 'apache' user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2498 to this issue.

When using the default SELinux 'targeted' policy on Red Hat Enterprise Linux 4, the impact of this issue is reduced since the scripts executed by PHP are constrained within the httpd_sys_script_t security context.

Users of PHP should upgrade to these updated packages, which contain backported fixes for these issues.

A Hardened-PHP Project Security Advisory reports :

When the library parses XMLRPC requests/responses, it constructs a string of PHP code, that is later evaluated. This means any failure to properly handle the construction of this string can result in arbitrary execution of PHP code.

This new injection vulnerability is cause by not properly handling the situation, when certain XML tags are nested in the parsed document, that were never meant to be nested at all. This can be easily exploited in a way, that user-input is placed outside of string delimiters within the evaluation string, which obviously results in arbitrary code execution.

Note that several applications contains an embedded version on XML_RPC, therefor making them the vulnerable to the same code injection vulnerability.

CAN-2005-1751 :

The php4-dev package ships a copy of the 'shtool' utility in /usr/lib/php4/build/, which provides useful functionality for developers of software packages. Eric Romang discovered that shtool created temporary files in an insecure manner. This could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the shtool program.

CAN-1005-1759 :

The creation of temporary files in shtool was also vulnerable to a race condition which allowed a local user to read the contents of the temporary file. However, this file does not usually contain sensitive information since shtool is usually used for building software packages.

CAN-2005-2498 :

Stefan Esser discovered another remote code execution vulnerability in the XMLRPC module of the PEAR (PHP Extension and Application Repository) extension of PHP. By sending specially crafted XMLRPC requests to an affected web server, a remote attacker could exploit this to execute arbitrary code with the web server's privileges.

In Ubuntu, the PEAR extension is unsupported (it is contained in the php4-pear package which is part of universe). However, since this is a highly critical vulnerability, that package was fixed anyway.

Please note that many applications contain a copy of the affected XMLRPC code, which must be fixed separately. The following packages may also be affected, but are unsupported in Ubuntu :

  - drupal - wordpress - phpwiki - horde3 - ewiki -     egroupware - phpgroupware

    These packages might be fixed by the community later.

    The following common third-party applications might be     affected as well, but not packaged for Ubuntu :

  - Serendipity - Postnuke - tikiwiki - phpwebsite

    If you run any affected software, please check whether     you are affected and upgrade it as soon as possible to     protect your server.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running Apple Mac OS X, but lacks Security Update 2005-009. This security update contains fixes for the following applications :
- Apache2
- Apache_mod_ssl
- CoreFoundation
- curl
- iodbcadmintool
- OpenSSL
- passwordserver
- Safari
- sudo
- syslog 

A problem was discovered in the PEAR XML-RPC Server package included in the php-pear package. If a PHP script which implements the XML-RPC Server is used, it would be possible for a remote attacker to construct an XML-RPC request which would cause PHP to execute arbitrary commands as the 'apache' user.

A new php5 package is available for Slackware 10.1 in /testing to fix security issues. PHP has been relinked with the shared PCRE library to fix an overflow issue with PHP's builtin PRCE code, and PEAR::XMLRPC has been upgraded to version 1.4.0 which eliminates the eval() function. The eval() function is believed to be insecure as implemented, and would be difficult to secure. Note that this new package now requires that the PCRE package be installed, so be sure to get the new package from the patches/packages/ directory if you don't already have it.

New PHP packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, and -current to fix security issues. PHP has been relinked with the shared PCRE library to fix an overflow issue with PHP's builtin PRCE code, and PEAR::XMLRPC has been upgraded to version 1.4.0 which eliminates the eval() function. The eval() function is believed to be insecure as implemented, and would be difficult to secure. Note that these new packages now require that the PCRE package be installed, so be sure to get the new package from the patches/packages/ directory if you don't already have it. A new version of this (6.3) was also issued today, so be sure that is the one you install.

Stefan Esser discovered a vulnerability in the XML-RPC libraries which are also present in egroupware, a web-based groupware suite, that allows injection of arbitrary PHP code into eval() statements.

The remote host is affected by the vulnerability described in GLSA-200509-19 (PHP: Vulnerabilities in included PCRE and XML-RPC libraries)

    PHP makes use of a private copy of libpcre which is subject to an     integer overflow leading to a heap overflow (see GLSA 200508-17). It     also ships with an XML-RPC library affected by a script injection     vulnerability (see GLSA 200508-13).
  Impact :

    An attacker could target a PHP-based web application that would     use untrusted data as regular expressions, potentially resulting in the     execution of arbitrary code. If web applications make use of the     XML-RPC library shipped with PHP, they are also vulnerable to remote     execution of arbitrary PHP code.
  Workaround :

    There is no known workaround at this time.

Stefan Esser of the Hardened-PHP Project reported a serious vulnerability in the third-party XML-RPC library included with some Drupal versions. An attacker could execute arbitrary PHP code on a target site. This update pulls in the latest XML-RPC version from upstream.

This update includes the latest upstream version of the PEAR XML_RPC package, which fixes a security issue in request parsing in the XML_RPC Server code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2498 to this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200508-21 (phpWebSite: Arbitrary command execution through XML-RPC and SQL injection)

    phpWebSite uses an XML-RPC library that improperly handles XML-RPC     requests and responses with malformed nested tags. Furthermore,     'matrix_killer' reported that phpWebSite is vulnerable to a SQL     injection attack.
  Impact :

    A malicious remote user could exploit this vulnerability to inject     arbitrary PHP script code into eval() statements by sending a specially     crafted XML document, and also inject SQL commands to access the     underlying database directly.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200508-20 (phpGroupWare: Multiple vulnerabilities)

    phpGroupWare improperly validates the 'mid' parameter retrieved     via a forum post. The current version of phpGroupWare also adds several     safeguards to prevent XSS issues, and disables the use of a potentially     vulnerable XML-RPC library.
  Impact :

    A remote attacker may leverage the XML-RPC vulnerability to     execute arbitrary PHP script code. He could also create a specially     crafted request that will reveal private posts.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in phpgroupware, a web-based groupware system written in PHP. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-2498     Stefan Esser discovered another vulnerability in the     XML-RPC libraries that allows injection of arbitrary PHP     code into eval() statements. The XMLRPC component has     been disabled.

  - CAN-2005-2600

    Alexander Heidenreich discovered a cross-site scripting     problem in the tree view of FUD Forum Bulletin Board     Software, which is also present in phpgroupware.

  - CAN-2005-2761

    A global cross-site scripting fix has also been included     that protects against potential malicious scripts     embedded in CSS and xmlns in various parts of the     application and modules.

This update also contains a postinst bugfix that has been approved for the next update to the stable release.

The remote host is affected by the vulnerability described in GLSA-200508-18 (PhpWiki: Arbitrary command execution through XML-RPC)

    Earlier versions of PhpWiki contain an XML-RPC library that     improperly handles XML-RPC requests and responses with malformed nested     tags.
  Impact :

    A remote attacker could exploit this vulnerability to inject     arbitrary PHP script code into eval() statements by sending a specially     crafted XML document to PhpWiki.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200508-14 (TikiWiki, eGroupWare: Arbitrary command execution through XML-RPC)

    The XML-RPC library shipped in TikiWiki and eGroupWare improperly     handles XML-RPC requests and responses with malformed nested tags.
  Impact :

    A remote attacker could exploit this vulnerability to inject     arbitrary PHP script code into eval() statements by sending a specially     crafted XML document to TikiWiki or eGroupWare.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200508-13 (PEAR XML-RPC, phpxmlrpc: New PHP script injection vulnerability)

    Stefan Esser of the Hardened-PHP Project discovered that the PEAR     XML-RPC and phpxmlrpc libraries were improperly handling XMLRPC     requests and responses with malformed nested tags.
  Impact :

    A remote attacker could exploit this vulnerability to inject     arbitrary PHP script code into eval() statements by sending a specially     crafted XML document to web applications making use of these libraries.
  Workaround :

    There are no known workarounds at this time.

Several security related problems have been found in PHP4, the server-side, HTML-embedded scripting language. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-1751     Eric Romang discovered insecure temporary files in the     shtool utility shipped with PHP that can exploited by a     local attacker to overwrite arbitrary files. Only this     vulnerability affects packages in oldstable.

  - CAN-2005-1921

    GulfTech has discovered that PEAR XML_RPC is vulnerable     to a remote PHP code execution vulnerability that may     allow an attacker to compromise a vulnerable server.

  - CAN-2005-2498

    Stefan Esser discovered another vulnerability in the     XML-RPC libraries that allows injection of arbitrary PHP     code into eval() statements.

The remote host is running phpAdsNew / phpPgAds, an open source banner ad server. 

The version of phpAdsNews / phpPgAds installed on the remote host suffers from several flaws :

  - Remote PHP Code Injection Vulnerability     The XML-RPC library bundled with the application allows     an attacker to inject arbitrary PHP code via the     'adxmlrpc.php' script to be executed within the context     of the affected web server user id.

  - Multiple Local File Include Vulnerabilities     The application fails to sanitize user-supplied input to     the 'layerstyle' parameter of the 'adlayer.php' script     and the 'language' parameter of the 'admin/js-form.php'     script before using them to include PHP files for     execution. An attacker can exploit these issues to read     arbitrary local files provided PHP's 'magic_quotes'     directive is disabled.

  - SQL Injection Vulnerability     An attacker can manipulate SQL queries via input to the     'clientid' parameter of the     'libraries/lib-view-direct.inc.php' script.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:748 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache     HTTP Web server.

    A bug was discovered in the PEAR XML-RPC Server package included in PHP. If     a PHP script is used which implements an XML-RPC Server using the PEAR     XML-RPC package, then it is possible for a remote attacker to construct an     XML-RPC request which can cause PHP to execute arbitrary PHP commands as     the 'apache' user. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-2498 to this issue.

    When using the default SELinux targeted policy on Red Hat Enterprise     Linux 4, the impact of this issue is reduced since the scripts executed by     PHP are constrained within the httpd_sys_script_t security context.

    Users of PHP should upgrade to these updated packages, which contain     backported fixes for these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running Apple Mac OS X, but lacks Security Update 2005-009. This security update contains fixes for the following applications :
- Apache2
- Apache_mod_ssl
- CoreFoundation
- curl
- iodbcadmintool
- OpenSSL
- passwordserver
- Safari
- sudo
- syslog

ID	Name	Product	Family	Severity
21960	CentOS 3 / 4 : php (CESA-2005:748)	Nessus	CentOS Local Security Checks	medium
21527	FreeBSD : pear-XML_RPC -- remote PHP code injection vulnerability (e65ad1bf-0d8b-11da-90d0-00304823c0d3)	Nessus	FreeBSD Local Security Checks	medium
20578	Ubuntu 4.10 / 5.04 : php4 vulnerabilities (USN-171-1)	Nessus	Ubuntu Local Security Checks	medium
3308	Mac OS X Multiple Vulnerabilities (Security Update 2005-009)	Nessus Network Monitor	Operating System Detection	high
19902	Mandrake Linux Security Advisory : php-pear (MDKSA-2005:146)	Nessus	Mandriva Local Security Checks	medium
19863	Slackware 10.1 : php5 in Slackware 10.1 (SSA:2005-251-04)	Nessus	Slackware Local Security Checks	high
19859	Slackware 10.0 / 10.1 / 8.1 / 9.0 / 9.1 / current : PHP (SSA:2005-242-02)	Nessus	Slackware Local Security Checks	high
19846	Debian DSA-842-1 : egroupware - missing input sanitising	Nessus	Debian Local Security Checks	medium
19818	GLSA-200509-19 : PHP: Vulnerabilities in included PCRE and XML-RPC libraries	Nessus	Gentoo Local Security Checks	high
19809	Debian DSA-840-1 : drupal - missing input sanitising	Nessus	Debian Local Security Checks	medium
19668	Fedora Core 4 : php-5.0.4-10.4 (2005-810)	Nessus	Fedora Local Security Checks	medium
19667	Fedora Core 3 : php-4.3.11-2.7 (2005-809)	Nessus	Fedora Local Security Checks	medium
19574	GLSA-200508-21 : phpWebSite: Arbitrary command execution through XML-RPC and SQL injection	Nessus	Gentoo Local Security Checks	medium
19573	GLSA-200508-20 : phpGroupWare: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
19568	Debian DSA-798-1 : phpgroupware - several vulnerabilities	Nessus	Debian Local Security Checks	medium
19538	GLSA-200508-18 : PhpWiki: Arbitrary command execution through XML-RPC	Nessus	Gentoo Local Security Checks	medium
19534	GLSA-200508-14 : TikiWiki, eGroupWare: Arbitrary command execution through XML-RPC	Nessus	Gentoo Local Security Checks	medium
19533	GLSA-200508-13 : PEAR XML-RPC, phpxmlrpc: New PHP script injection vulnerability	Nessus	Gentoo Local Security Checks	medium
19532	Debian DSA-789-1 : php4 - several vulnerabilities	Nessus	Debian Local Security Checks	high
19518	phpAdsNew / phpPgAds < 2.0.6 Multiple Vulnerabilities	Nessus	CGI abuses	high
19491	RHEL 4 : php (RHSA-2005:748)	Nessus	Red Hat Local Security Checks	critical
800798	Mac OS X Multiple Vulnerabilities (Security Update 2005-009)	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2005-2498

critical

Tenable Plugins

medium

medium

medium

high

medium

high

high

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

critical

high