CVE-2005-2498: Code Injection
First published: Mon Aug 15 2005(Updated: )
Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Edd Dumbill Phpxmlrpc | =1.1.1 | |
| Gggeek Phpxmlrpc | <=1.1.1 | |
| Debian Debian Linux | =3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.hardened-php.net/advisory_152005.67.html
- http://www.redhat.com/support/errata/RHSA-2005-748.html
- http://www.debian.org/security/2005/dsa-798
- http://www.debian.org/security/2005/dsa-789
- http://www.gentoo.org/security/en/glsa/glsa-200509-19.xml
- http://www.fedoralegacy.org/updates/FC2/2005-11-28-FLSA_2005_166943__Updated_php_packages_fix_security_issues.html
- http://secunia.com/advisories/16431
- http://secunia.com/advisories/16432
- http://secunia.com/advisories/16441
- http://secunia.com/advisories/16460
- http://secunia.com/advisories/16465
- http://secunia.com/advisories/16468
- http://secunia.com/advisories/16469
- http://secunia.com/advisories/16491
- http://secunia.com/advisories/16550
- http://secunia.com/advisories/16558
- http://secunia.com/advisories/16563
- http://secunia.com/advisories/16619
- http://secunia.com/advisories/16635
- http://secunia.com/advisories/16693
- http://secunia.com/advisories/16976
- http://secunia.com/advisories/17440
- http://www.debian.org/security/2005/dsa-840
- http://www.debian.org/security/2005/dsa-842
- http://secunia.com/advisories/17053
- http://secunia.com/advisories/17066
- http://www.securityfocus.com/archive/1/408125
- http://www.securityfocus.com/bid/14560
- http://www.novell.com/linux/security/advisories/2005_49_php.html
- http://marc.info/?l=bugtraq&m=112412415822890&w=2
- http://marc.info/?l=bugtraq&m=112431497300344&w=2
- http://marc.info/?l=bugtraq&m=112605112027335&w=2
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9569
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/remedy
- agent/severity
- agent/weakness
- agent/author
- agent/references
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/event
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/edd dumbill
- canonical/edd dumbill phpxmlrpc
- version/edd dumbill phpxmlrpc/1.1.1
- vendor/gggeek
- canonical/gggeek phpxmlrpc
- version/gggeek phpxmlrpc/1.1.1
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/3.1