| Server IP : 103.119.228.120 / Your IP : 3.23.103.216 Web Server : Apache System : Linux v8.techscape8.com 3.10.0-1160.119.1.el7.tuxcare.els2.x86_64 #1 SMP Mon Jul 15 12:09:18 UTC 2024 x86_64 User : nobody ( 99) PHP Version : 5.6.40 Disable Function : shell_exec,symlink,system,exec,proc_get_status,proc_nice,proc_terminate,define_syslog_variables,syslog,openlog,closelog,escapeshellcmd,passthru,ocinum cols,ini_alter,leak,listen,chgrp,apache_note,apache_setenv,debugger_on,debugger_off,ftp_exec,dl,dll,myshellexec,proc_open,socket_bind,proc_close,escapeshellarg,parse_ini_filepopen,fpassthru,exec,passthru,escapeshellarg,escapeshellcmd,proc_close,proc_open,ini_alter,popen,show_source,proc_nice,proc_terminate,proc_get_status,proc_close,pfsockopen,leak,apache_child_terminate,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,dl,symlink,shell_exec,system,dl,passthru,escapeshellarg,escapeshellcmd,myshellexec,c99_buff_prepare,c99_sess_put,fpassthru,getdisfunc,fx29exec,fx29exec2,is_windows,disp_freespace,fx29sh_getupdate,fx29_buff_prepare,fx29_sess_put,fx29shexit,fx29fsearch,fx29ftpbrutecheck,fx29sh_tools,fx29sh_about,milw0rm,imagez,sh_name,myshellexec,checkproxyhost,dosyayicek,c99_buff_prepare,c99_sess_put,c99getsource,c99sh_getupdate,c99fsearch,c99shexit,view_perms,posix_getpwuid,posix_getgrgid,posix_kill,parse_perms,parsesort,view_perms_color,set_encoder_input,ls_setcheckboxall,ls_reverse_all,rsg_read,rsg_glob,selfURL,dispsecinfo,unix2DosTime,addFile,system,get_users,view_size,DirFiles,DirFilesWide,DirPrintHTMLHeaders,GetFilesTotal,GetTitles,GetTimeTotal,GetMatchesCount,GetFileMatchesCount,GetResultFiles,fs_copy_dir,fs_copy_obj,fs_move_dir,fs_move_obj,fs_rmdir,SearchText,getmicrotime MySQL : ON | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /usr/local/ssl/local/ssl/local/ssl/local/ssl/local/ssl/share/doc/xmlrpc-c-1.32.5/ |
Upload File : |
Security Advisories
===================
The Xmlrpc-c maintainer will normally post security advisories related
to xmlrpc-c to the xmlrpc-c-announce mailing list. You can subscribe
to this using the web:
http://xmlrpc-c.sourceforge.net/lists.php
You will also find a list of all known bugs including those with
security ramifications, in the release notes on Sourceforge. To see
the release notes for a release, go to the file download page and
click on the release name. The list is current only for the most
current release -- i.e. we stop adding to the list for release N after
we release N+1.
XML-RPC Security
================
There are some security issues inherent in XML-RPC:
1) XML-RPC messages are not encrypted at the XML-RPC level. This
means that unless you encrypt them at some lower level, someone
with sufficient access to the network can see them with standard
packet-sniffing and network administration tools.
This is especially dangerous because XML-RPC is a stateless protocol.
If you include reusable authentication tokens in an XML-RPC call, they
can probably be sniffed and used by attackers.
You can solve this problem by using SSL under HTTP. This is possible
with Xmlrpc-c, but it's nontrivial to set up and the Xmlrpc-c
documentation doesn't tell you how.
2) There are no permission restrictions and no authentication built
into Xmlrpc-c by default -- any client can call any method on any
visible server and neither can know for sure to whom it is talking.
If you need permission and authentication, you either have to put
it above the XML-RPC layer or below. For a server, above means in
the method code you supply and register with the Xmlrpc-c server
facilities; below means something like a firewall that lets clients
only from a certain IP address connect to your server.
3) XML-RPC is a complex protocol based on complex data structures.
Layers and layers of potentially buggy code gets run between the
time network data is received, and the time it is understood; and
conversely between the time data is conceived and the time it
gets sent.