festival.edmaven.com:80

Linux b747.shapiroconsult.com 3.10.0-1160.119.1.vz7.224.4 #1 SMP Mon Sep 30 15:36:27 MSK 2024 x86_64
Apache
173.231.212.80

SECURITY

Security Advisories
===================

The Xmlrpc-c maintainer will normally post security advisories related
to xmlrpc-c to the xmlrpc-c-announce mailing list.  You can subscribe
to this using the web:

http://xmlrpc-c.sourceforge.net/lists.php

You will also find a list of all known bugs including those with
security ramifications, in the release notes on Sourceforge.  To see
the release notes for a release, go to the file download page and
click on the release name.  The list is current only for the most
current release -- i.e. we stop adding to the list for release N after
we release N+1.

XML-RPC Security
================

There are some security issues inherent in XML-RPC:

1) XML-RPC messages are not encrypted at the XML-RPC level.  This
     means that unless you encrypt them at some lower level, someone
     with sufficient access to the network can see them with standard
     packet-sniffing and network administration tools.

This is especially dangerous because XML-RPC is a stateless protocol.
     If you include reusable authentication tokens in an XML-RPC call, they
     can probably be sniffed and used by attackers.

You can solve this problem by using SSL under HTTP.  This is possible
     with Xmlrpc-c, but it's nontrivial to set up and the Xmlrpc-c
     documentation doesn't tell you how.

2) There are no permission restrictions and no authentication built
     into Xmlrpc-c by default -- any client can call any method on any
     visible server and neither can know for sure to whom it is talking.

If you need permission and authentication, you either have to put
     it above the XML-RPC layer or below.  For a server, above means in
     the method code you supply and register with the Xmlrpc-c server
     facilities; below means something like a firewall that lets clients
     only from a certain IP address connect to your server.

3) XML-RPC is a complex protocol based on complex data structures.
     Layers and layers of potentially buggy code gets run between the
     time network data is received, and the time it is understood; and
     conversely between the time data is conceived and the time it
     gets sent.

Name	Type	Size	Owner/Group	Permission	Last Modified	Actions
.	dir	-	root/root	0755	2020-12-08 04:52:34
..	dir	-	root/root	0755	2026-07-30 03:51:20
COPYING	text/plain	6.62 KB	root/root	0644	2007-12-27 11:08:57
CREDITS	text/plain	674 B	root/root	0644	2005-05-22 10:38:24
DEVELOPING	text/plain	2.9 KB	root/root	0644	2005-05-22 10:38:24
HISTORY	text/plain	3.23 KB	root/root	0644	2007-12-27 11:08:57
SECURITY	text/plain	2.15 KB	root/root	0644	2005-05-22 10:38:24
TESTING	text/plain	2.73 KB	root/root	0644	2005-05-22 10:38:24
TODO	text/plain	2.23 KB	root/root	0644	2007-02-17 11:48:44