[UNIX] Serendipity Remote Code Execution

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Serendipity Remote Code Execution
------------------------------------------------------------------------

SUMMARY

"Serendipity is a weblog/blog system, implemented with PHP. It is
standards compliant, feature rich and open source (BSD License).
Serendipity is constantly under active development, with a team of
talented developers trying to make the best PHP powered blog on the net."

The XML-RPC parser used by the Serendipity product is vulnerable to remote
code execution.

DETAILS

Vulnerable Systems:
* Serendipity versions 0.8.2 and prior

Immune Systems:
* Serendipity versions 0.8.2 (patched version
<http://prdownloads.sourceforge.net/php-blog/serendipity-0.8.2.tar.gz>
here)

An attacker can send a forged POST request to the victim's blog and
include PHP code in the request body. This code is executed in the context
of the affected Serendipity instance. Since the vulnerability is extremely
easy to exploit and apart from one POST request, no suspicious activity is
logged, it could be used for automated mass defacements and viral
reproduction, similar to Santy.

The maintainer of PEAR::XML_RPC has released an updated version that fixes
the vulnerability. The Serendipity team has released a fixed version, too.

Disclosure Timeline:
29.06.05 - Vulnerability discovered and vendor notified
29.06.05 - Vendor released bugfixed version
29.06.05 - Public disclosure

Related CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1921>
CAN-2005-1921

ADDITIONAL INFORMATION

The information has been provided by
<mailto:christopher.kunz@hardened-php.net> Christopher Kunz.
The original article can be found at:
<http://www.hardened-php.net/advisory-022005.php>
http://www.hardened-php.net/advisory-022005.php

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.