PHP hit by another critical flaw

A fresh security flaw has surfaced in widespread Web service protocol PHP which could allow attackers to take control of vulnerable servers.

The bug was found in XML-RPC For PHP and PEAR XML_RPC as the result of a security audit by the Hardened-PHP project. The group said it decided to carry out its own audit after other flaws were disclosed in the two libraries earlier this summer.

The new bug takes advantage of a technique similar to the earlier bugs, involving eval() statements, Hardened-PHP said. "To get rid of this and future eval() injection vulnerabilities, the Hardened-PHP Project has developed together with the maintainers of both libraries a fix that completely eliminates the use of eval() from the library," the project said in its advisory.

XML-based RPC (Remote Procedure Call) systems such as XML-RPC are used with HTTP to power Web services, a simple and increasingly popular way of providing services online. XML-RPC For PHP (also called PHPXMLRPC) and PEAR XML_RPC implement XML-RPC for the PHP scripting language.

The bug affects a large number of Web applications, particularly PHP-based blogging, wiki and content management programs, according to security experts. The PHPXMLRPC and PEAR XML_RPC libraries is used in many popular Web applications such as PostNuke, Drupal, b2evolution and TikiWiki.

Content-management systems and blogs are increasingly used by large corporations as a way of interacting with customers and the public -- IBM even jumped into the enterprise blogging game recently.

Version 1.4.0 of PEAR XML_RPC fixes the problem, and is available from the PEAR website.

PHPXMLRPC is fixed with version 1.2, available from the PHPXMLRPC project site.

Software projects using the libraries have issued their own updates fixing the problem; among these are the PHP packages included with the Red Hat and Ubuntu Linux distributions.

FrSIRT, the French Security Incident Response Team, gave the flaw a "high-risk" rating and independent security firm Secunia said it was "highly critical."

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Matthew Broersma

Techworld.com
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?