TikiWiki XML-RPC Library Remote Code Execution Vulnerability

[Brad]

* Technical Description *

A vulnerability was identified in TikiWiki, which could be exploited by remote attackers to execute arbitrary commands. This flaw is due to an input validation error in the Pear XML-RPC library, which could be exploited by attackers to execute arbitrary commands and compromise a vulnerable web server. For additional information, see : FrSIRT/ADV-2005-0911

 * Affected Products *

TikiWiki version 1.8.5 and prior

 * Solution *

Disable the XML-RPC support.

The FrSIRT is not aware of any official supplied patch for this issue.

 * References *

http://www.frsirt.com/english/advisories/2005/0985
http://www.gentoo.org/security/en/glsa/glsa-200507-06.xml