Argument injection vulnerability in the ping function in Ping.php in the Net_Ping package before 2.4.5 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: this has also been reported as a shell metacharacter problem.

It was discovered that php-net-ping, a PHP PEAR module to execute ping independently of the Operating System, performs insufficient input sanitising, which might be used to inject arguments (no CVE yet) or execute arbitrary commands (CVE-2009-4024 ) on a system that uses php-net-ping.

PEAR Security Advisory reports :

Multiple remote arbitrary command injections have been found in the Net_Ping and Net_Traceroute.

When input from forms are used directly, the attacker could pass variables that would allow him to execute remote arbitrary command injections.

Upstream Changelog Version 2.4.5 - QA Release: * Prevent command injection [saltybeagle] (CVE-2009-4024)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
44814	Debian DSA-1949-1 : php-net-ping - programming error	Nessus	Debian Local Security Checks	critical
43626	FreeBSD : PEAR -- Net_Ping and Net_Traceroute remote arbitrary command injection (56ba8728-f987-11de-b28d-00215c6a37bb)	Nessus	FreeBSD Local Security Checks	critical
42909	Fedora 10 : php-pear-Net-Ping-2.4.5-1.fc10 (2009-12156)	Nessus	Fedora Local Security Checks	critical
42906	Fedora 11 : php-pear-Net-Ping-2.4.5-1.fc11 (2009-11613)	Nessus	Fedora Local Security Checks	critical
42904	Fedora 12 : php-pear-Net-Ping-2.4.5-1.fc12 (2009-11523)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2009-4024

critical

Tenable Plugins

critical

critical

critical

critical

critical