Drupal XML-RPC for PHP Nested Tags Remote Code Execution

[TJ]

* Technical Description *

A vulnerability was identified in Drupal, which could be exploited by remote attackers to execute arbitrary code. This flaw is due to an input validation error in the XML-RPC library when processing, via an "eval()" call, certain XML tags nested in parsed documents, which could be exploited by remote attackers to execute arbitrary PHP commands. For additional information, see : FrSIRT/ADV-2005-1413

 * Affected Products *

Drupal version 4.6.0 through 4.6.2
Drupal version 4.5.0 through 4.5.4

 * Solution *

Upgrade to Drupal version 4.5.5 or 4.6.3 :
http://drupal.org/project

 * References *

http://www.frsirt.com/english/advisories/2005/1415
http://drupal.org/files/sa-2005-004/advisory.txt