PEAR Blog: Net_Traceroute and Net_Ping security advisory
An advisory has been issued on the PEAR blog about two packages – Net_Traceroute and Net_Ping – that could expose your site to a security issue, a remote arbitrary command injection.
Net_Ping is an OS independent wrapper class for executing ping calls from PHP. Net_Traceroute is an OS independent wrapper class for executing traceroute calls from PHP. When input from forms are used directly, the attacker could pass variables that would allow him to execute remote arbitrary command injections.
You can use filtering as a workaround until your packages are updated on your server. You can upgrade to the latest packages here: Net_Ping, Net_Traceroute.