PT-2014-4867 · Zend · Zendservice Nirvanix+10

Lukas Reschke · Publicado 2014-04-03 · Atualizado 2022-05-14 · CVE-2014-2681

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Zend Framework 1 versions 1.12.3 and earlier Zend Framework 2 versions 2.1.5 and earlier, 2.2.x versions 2.2.5 and earlier ZendOpenId version 2.0.1 and earlier ZendRest version 2.0.1 and earlier ZendService AudioScrobbler version 2.0.1 and earlier ZendService Nirvanix version 2.0.1 and earlier ZendService SlideShare version 2.0.1 and earlier ZendService Technorati version 2.0.1 and earlier ZendService WindowsAzure version 2.0.1 and earlier ZendService Amazon version 2.0.2 and earlier ZendService Api version 0.9.9 and earlier

Description The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service via an XML External Entity (XXE) attack. This occurs due to an incomplete fix for a previous issue.

Recommendations For Zend Framework 1 versions 1.12.3 and earlier, update to version 1.12.4 or later. For Zend Framework 2 versions 2.1.5 and earlier, update to version 2.1.6 or later. For Zend Framework 2 versions 2.2.x 2.2.5 and earlier, update to version 2.2.6 or later. For ZendOpenId version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendRest version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService AudioScrobbler version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService Nirvanix version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService SlideShare version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService Technorati version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService WindowsAzure version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService Amazon version 2.0.2 and earlier, update to version 2.0.3 or later. For ZendService Api version 0.9.9 and earlier, update to version 1.0.0 or later.

Correção

DoS

XXE

Enumeração de Fraquezas

CWE-19

CWE-611

Identificadores relacionados

CVE-2014-2681

DLA-251-1

DSA-3265-1

DSA-3265-2

GHSA-43XG-87XW-JPV8

MGASA-2014-0151

Produtos afetados

Zend Framework 1

Zend Framework 2

Zendopenid

Zendrest

Zendservice Amazon

Zendservice Api

Zendservice Audioscrobbler

Zendservice Nirvanix

Zendservice Slideshare

Zendservice Technorati

Zendservice Windowsazure

Referências · 37

• http://framework.zend.com/security/advisory/ZF2014-02 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5657 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681 · Nota
• http://debian.org/security/2015/dsa-3265 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-43xg-87xw-jpv8 · Aviso do Fabricante
• https://web.archive.org/web/20150523055201/http://mandriva.com/en/support/security/advisories/advisory/MDVSA-2014:072/?name=MDVSA-2014:072 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-2681 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1081288 · Nota
• https://secunia.com/advisories/57276 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2014:072 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6532 · Nota de Segurança