Serendipity Remote Exploit – 0.8.2 veröffentlicht

Aufgrund eines kritischen Fehlers in der mitgelieferten XML-RPC Bibliothek wurde gestern Version 0.8.2 von Gottes eigenem Weblog, Serendipty, veröffentlicht. Es wird geraten, entweder auf Version 0.8.2 upzudaten oder die Datei serendipity_xmlrpc.php zu löschen.

Changelog

Version 0.8.2 (June 29th, 2005)
————————————————————————

- fixed remote code execution vulnerability. Thanks to Gulftech  Research for pointing out that bug and Stefan Esser for helping  fix it (nohn)

- Updated Spartacus to most recent version (nohn)

- fixed serendipity_traversePath() -  PHP5 issue with array_merge()  Thanks to jdhawk for the fix (flotsam)

- CSS does no longer emit cache-restricting headers, so that the  stylesheets can be cached by the browser for followup-requests  Thanks to Sencer for pointing this out! (garvinhicking)

- Patch/Bug #1209410 by swiesinger: When using shortcut admin URL,  use https:// when specified by user

- Fix deleting categories when having privileges but not being  administrator (Patch #1205347, many thanks to Penny Leach)

- Increased level of output message from the Spartacus plugin  (garvinhicking)

- Patched XML-RPC functions, thanks to Tim Putnam. This should enable  XML-RPC services to properly fetch existing articles and edit them.

- Fix Plugin API call performing too many unneeded SQL queries  (garvinhicking)

- Fix missing authorname when previewing entry. Thanks to winkiller,  aquatic, thomas, wurstprinz and hansi for fixing this!

Via Kris, Sebastian Nohn, Hardened PHP Forum.

Betroffen war nicht nur Serendipity, sondern u.a. auch Drupal, Xoops, TikiWiki, phpMyFAQ und Wortpresse (die nebenher auch noch mit diversen SQL-Injections und XSS zu kämpfen haben).