PT-2006-5232 · Zend · Zend Platform

Stefan Esser · Publicado 2006-08-29 · Atualizado 2018-10-17 · CVE-2006-4431

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zend Platform versions 2.2.1 and earlier

Description The issue is related to multiple buffer overflows in the Session Clustering Daemon and the mod cluster module. This can be exploited by remote attackers who can cause a denial of service (crash) or execute arbitrary code via a crafted PHP session identifier (PHPSESSID), which can be either empty or specially crafted.

Recommendations For Zend Platform versions 2.2.1 and earlier, update to a version that contains a fix for this issue to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2006-4431

Produtos afetados

Zend Platform

Referências · 11

• http://securityfocus.com/archive/1/444263/100/0/threaded · Nota
• http://vupen.com/english/advisories/2006/3388 · Aviso do Fabricante
• http://marc.info/?l=full-disclosure&m=115642248226217&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28573 · Nota
• http://osvdb.org/28230 · Nota
• http://secunia.com/advisories/21573 · Aviso do Fabricante
• http://osvdb.org/28231 · Nota
• http://hardened-php.net/advisory_052006.128.html · Aviso do Fabricante
• http://securityfocus.com/bid/19692 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4431 · Nota de Segurança
• http://securityreason.com/securityalert/1466 · Nota