PHP hit by another critical flaw

A fresh security flaw has surfaced in widespread Web service protocol PHP which could allow attackers to take control of vulnerable servers.

The bug was found in XML-RPC For PHP and PEAR XML_RPC as the result of a security audit by the Hardened-PHP project. The group said it decided to carry out its own audit after other flaws were disclosed in the two libraries earlier this summer.

The new bug takes advantage of a technique similar to the earlier bugs, involving eval() statements, Hardened-PHP said. "To get rid of this and future eval() injection vulnerabilities, the Hardened-PHP Project has developed together with the maintainers of both libraries a fix that completely eliminates the use of eval() from the library," the project said in its advisory.

XML-based RPC (Remote Procedure Call) systems such as XML-RPC are used with HTTP to power Web services, a simple and increasingly popular way of providing services online. XML-RPC For PHP (also called PHPXMLRPC) and PEAR XML_RPC implement XML-RPC for the PHP scripting language.

The bug affects a large number of Web applications, particularly PHP-based blogging, wiki and content management programs, according to security experts. The PHPXMLRPC and PEAR XML_RPC libraries is used in many popular Web applications such as PostNuke, Drupal, b2evolution and TikiWiki.

Content-management systems and blogs are increasingly used by large corporations as a way of interacting with customers and the public -- IBM even jumped into the enterprise blogging game recently.

Version 1.4.0 of PEAR XML_RPC fixes the problem, and is available from the PEAR website.

PHPXMLRPC is fixed with version 1.2, available from the PHPXMLRPC project site.

Software projects using the libraries have issued their own updates fixing the problem; among these are the PHP packages included with the Red Hat and Ubuntu Linux distributions.

FrSIRT, the French Security Incident Response Team, gave the flaw a "high-risk" rating and independent security firm Secunia said it was "highly critical."

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Matthew Broersma

Techworld.com
Show Comments

Essentials

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?