PEAR XML_RPC Vulnerability and PHP 4.4.0RC2 release

The issue isn't just pear; a lot of common php apps - Tikiwiki; PostNuke; Drupal; b2evolution etc, which ship with their own versions of the xmlrpc(s).inc files.

Affected programs will need updating. The fix I'm using, is to grep all xmlrpc*.inc files for eval('$m->addParam(' . $_xh[$parser]['params'][$i]. ");"); and then overwrite the effected xmlrpc.inc and xmlrpcs.inc files with the updated ones, across the board.

--HV

More investigation found that --with-xmlrpc is not effected
 
Last edited:
Back
Top