11/5/2005

XML-RPC Attack Affects Blog Systems

Filed under: — By Aviran Mordo @ 7:57 am

There are reports on an attack exploiting xml-rpc for php vulnerability.

xml-rpc for php is used in a large number of popular web applications such as PostNuke, Drupal, b2evolution, Xoops, WordPress, PHPGroupWare and TikiWiki. When exploited, this could compromise a vulnerable system (complete list of vulnerable systems).

An attacker may exploit this issue to execute arbitrary commands or code in the context of the Web server. This may facilitate various attacks including unauthorized remote access.

XML-RPC for PHP 1.1 and prior versions are affected by this issue. Other applications using this library are also affected.

The security web site Secunia rates this vulnerability as Highly critical.

Most of the affected systems have put out a pach to fix this problem (complete list)

 

Leave a Reply

You must have Javascript enabled in order to submit comments.

All fields are optional (except comment).
Some comments may be held for moderation (depends on spam filter) and not show up immediately.
Links will automatically get rel="nofollow" attribute to deter spammers.

Powered by WordPress