[UNIX] Serendipity Remote Code Execution

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Serendipity Remote Code Execution
------------------------------------------------------------------------


SUMMARY

"Serendipity is a weblog/blog system, implemented with PHP. It is 
standards compliant, feature rich and open source (BSD License). 
Serendipity is constantly under active development, with a team of 
talented developers trying to make the best PHP powered blog on the net."

The XML-RPC parser used by the Serendipity product is vulnerable to remote 
code execution.

DETAILS

Vulnerable Systems:
 * Serendipity versions 0.8.2 and prior

Immune Systems:
 * Serendipity versions 0.8.2 (patched version  
<http://prdownloads.sourceforge.net/php-blog/serendipity-0.8.2.tar.gz> 
here)

An attacker can send a forged POST request to the victim's blog and 
include PHP code in the request body. This code is executed in the context 
of the affected Serendipity instance. Since the vulnerability is extremely 
easy to exploit and apart from one POST request, no suspicious activity is 
logged, it could be used for automated mass defacements and viral 
reproduction, similar to Santy.

The maintainer of PEAR::XML_RPC has released an updated version that fixes 
the vulnerability. The Serendipity team has released a fixed version, too.

Disclosure Timeline:
29.06.05 - Vulnerability discovered and vendor notified
29.06.05 - Vendor released bugfixed version
29.06.05 - Public disclosure

Related CVE Information:
 <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1921> 
CAN-2005-1921


ADDITIONAL INFORMATION

The information has been provided by  
<mailto:[email protected]> Christopher Kunz.
The original article can be found at:  
<http://www.hardened-php.net/advisory-022005.php> 
http://www.hardened-php.net/advisory-022005.php



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.