安全指标

Question

在执行PCI合规性安全指标扫描时，出现以下错误消息。有谁知道如何解决这个问题？

*Title: vulnerable web program (phpRPC) Impact: A remote attacker could execute arbitrary commands, create or overwrite files, or view files or directories on the web server. 

Data Sent: POST /ie/modules/phpRPC/server.php HTTP/1.0 

Host: example.com 

Content-type: text/xml Content-Length:162 <?xml version="1.0"?> <methodCall> <methodName>test.method</methodName> <params> <param> <value><base64>'));system(id);exit; </param> </params> </methodCall> 

Data Received: ????<img height="1" width="1" style="border- style:none;" alt="" src="//googleads.g.doubleclick.net/p agead/viewthroughconversion/997970389/?value=0&amp;label=PlcJCKu92AQ Q1aPv2wM&amp;guid=ON&amp;script=0"/> 

Resolution: 03/09/06 CVE 2006-1032 phpRPC is an xmlrpc library that uses database and rpc-protocol abstraction. It is prone to a remote code execution vulnerability because the decode() function within the rpc_decoder.php script fails to adequately sanitize user-supplied input before processing it in an eval() call. 
Successful exploitation would result in arbitrary code execution in the context of the application. PHP scripts that implement the phpRPC library, such as RunCMS, are affected by this issue. RunCMS 1.1 through 1.3.a5 are affected, as is phpRPC up to 0.7. 

Resolution: phpRPC is not currently being maintained. RunCMS users should upgrade to a version higher than 1.3.a5 which will hopefully include a fix. 

Risk Factor: High/ CVSS2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) CVE: CVE-2006-1032 BID: 16833 [Less]* 

Answer 1

这是一个比较严重的问题，因为服务器上的RPC服务可供攻击者使用。在不知道系统的具体情况的情况下，我不能推荐特定的修复程序。但是，您看到的漏洞很可能是由过时的系统造成的。您应该升级并安装所有修补程序。如果你的平台已经EOLed，移动到更新的东西。 The Common Vulnerability Enumeration has some specific information about the vulnerability identified by your scanner that may help you.

Answer 2

现在这是一个比较老的问题，但我相信这是答案，因为我有完全相同的问题。

安全指标可以有效地试图调用的id Linux命令这将返回类似这样uid=1000(rob) gid=1000(rob) groups=...

我的理论是，安全度量的检查字符串uid=的反应，看看是否该代码已被执行的远程服务器。这将巧合匹配Google的再营销代码。例如。在你的问题的UID =部分：src="//googleads.g.doubleclick.net/p agead/viewthroughconversion/997970389/?value=0&label=PlcJCKu92AQ Q1aPv2wM&guid=ON&script=0"

我的解决办法是，在我们的404页完全删除谷歌再营销标签，而不是仅仅把它注释掉了JS或HTML注释。因为这是404页面被返回的URL，他们张贴到（/scripts/modules/phpRPC/server.php）尝试找到利用。

我希望这可以帮助你，或任何其他人遇到这个问题。

感谢，

罗布