PT-2007-2764 · Zend · Zend Platform

Publicado 2007-03-09 · Atualizado 2017-07-29 · CVE-2007-1369

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Média

Vetor base

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zend Platform versions 2.2.3 and earlier

Description The issue allows local users to modify the system php.ini file. This is achieved by editing a copy of the php.ini file using the -f parameter and then performing a symlink attack. The attack involves creating a directory with an attacker-controlled php.ini file and linking this directory to /usr/local/Zend/etc.

Recommendations For Zend Platform versions 2.2.3 and earlier, consider restricting access to the ini modifier function to prevent unauthorized modifications to the system php.ini file. As a temporary workaround, restrict write access to the /usr/local/Zend/etc directory to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-1369

Produtos afetados

Zend Platform

Referências · 10

• 🔥 https://exploit-db.com/exploits/29712 · Exploit
• http://zend.com/products/zend_platform/security_vulnerabilities · Aviso do Fabricante
• http://osvdb.org/33930 · Nota
• http://php-security.org/MOPB/BONUS-07-2007.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/0829 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1369 · Nota de Segurança
• http://osvdb.org/32773 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32820 · Nota
• http://secunia.com/advisories/24501 · Nota
• http://securityfocus.com/bid/22802 · Nota