安全指標

Question

在執行PCI合規性安全指標掃描時，出現以下錯誤消息。有誰知道如何解決這個問題？

*Title: vulnerable web program (phpRPC) Impact: A remote attacker could execute arbitrary commands, create or overwrite files, or view files or directories on the web server. 

Data Sent: POST /ie/modules/phpRPC/server.php HTTP/1.0 

Host: example.com 

Content-type: text/xml Content-Length:162 <?xml version="1.0"?> <methodCall> <methodName>test.method</methodName> <params> <param> <value><base64>'));system(id);exit; </param> </params> </methodCall> 

Data Received: ????<img height="1" width="1" style="border- style:none;" alt="" src="//googleads.g.doubleclick.net/p agead/viewthroughconversion/997970389/?value=0&amp;label=PlcJCKu92AQ Q1aPv2wM&amp;guid=ON&amp;script=0"/> 

Resolution: 03/09/06 CVE 2006-1032 phpRPC is an xmlrpc library that uses database and rpc-protocol abstraction. It is prone to a remote code execution vulnerability because the decode() function within the rpc_decoder.php script fails to adequately sanitize user-supplied input before processing it in an eval() call. 
Successful exploitation would result in arbitrary code execution in the context of the application. PHP scripts that implement the phpRPC library, such as RunCMS, are affected by this issue. RunCMS 1.1 through 1.3.a5 are affected, as is phpRPC up to 0.7. 

Resolution: phpRPC is not currently being maintained. RunCMS users should upgrade to a version higher than 1.3.a5 which will hopefully include a fix. 

Risk Factor: High/ CVSS2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE: CVE-2006-1032 BID: 16833 [Less]* 

Answer 1

這是一個比較嚴重的問題，因爲服務器上的RPC服務可供攻擊者使用。在不知道系統的具體情況的情況下，我不能推薦特定的修復程序。但是，您看到的漏洞很可能是由過時的系統造成的。您應該升級並安裝所有修補程序。如果你的平臺已經EOLed，移動到更新的東西。 The Common Vulnerability Enumeration has some specific information about the vulnerability identified by your scanner that may help you.

Answer 2

現在這是一個比較老的問題，但我相信這是答案，因爲我有完全相同的問題。

安全指標可以有效地試圖調用的id Linux命令這將返回類似這樣uid=1000(rob) gid=1000(rob) groups=...

我的理論是，安全度量的檢查字符串uid=的反應，看看是否該代碼已被執行的遠程服務器。這將巧合匹配Google的再營銷代碼。例如。在你的問題的UID =部分：src="//googleads.g.doubleclick.net/p agead/viewthroughconversion/997970389/?value=0&label=PlcJCKu92AQ Q1aPv2wM&guid=ON&script=0"

我的解決辦法是，在我們的404頁完全刪除谷歌再營銷標籤，而不是僅僅把它註釋掉了JS或HTML註釋。因爲這是404頁面被返回的URL，他們張貼到（/scripts/modules/phpRPC/server.php）嘗試找到利用。

我希望這可以幫助你，或任何其他人遇到這個問題。

感謝，

羅布