PT-2014-4868 · Zend+1 · Zendservice Nirvanix+11

Publicado 2014-04-03 · Atualizado 2022-05-14 · CVE-2014-2682

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zend Framework 1 versions 1.12.3 and earlier Zend Framework 2 versions 2.1.5 and earlier, 2.2.x versions 2.2.5 and earlier ZendOpenId version 2.0.1 and earlier ZendRest version 2.0.1 and earlier ZendService AudioScrobbler version 2.0.1 and earlier ZendService Nirvanix version 2.0.1 and earlier ZendService SlideShare version 2.0.1 and earlier ZendService Technorati version 2.0.1 and earlier ZendService WindowsAzure version 2.0.1 and earlier ZendService Amazon version 2.0.2 and earlier ZendService Api version 0.9.9 and earlier

Description The issue is related to the improper sharing of the libxml disable entity loader setting between threads when PHP-FPM is used. This might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference.

Recommendations For Zend Framework 1 versions 1.12.3 and earlier, update to version 1.12.4 or later. For Zend Framework 2 versions 2.1.5 and earlier, update to version 2.1.6 or later. For Zend Framework 2 versions 2.2.x 2.2.5 and earlier, update to version 2.2.6 or later. For ZendOpenId version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendRest version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService AudioScrobbler version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService Nirvanix version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService SlideShare version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService Technorati version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService WindowsAzure version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService Amazon version 2.0.2 and earlier, update to version 2.0.3 or later. For ZendService Api version 0.9.9 and earlier, update to version 1.0.0 or later.

Correção

XML Entity Expansion

XXE

Enumeração de Fraquezas

CWE-776

CWE-19

CWE-611

Identificadores relacionados

CVE-2014-2682

DLA-251-1

DSA-3265-1

DSA-3265-2

GHSA-GP39-H9C2-QW79

MGASA-2014-0151

Produtos afetados

Php-Fpm

Zend Framework 1

Zend Framework 2

Zendopenid

Zendrest

Zendservice Amazon

Zendservice Api

Zendservice Audioscrobbler

Zendservice Nirvanix

Zendservice Slideshare

Zendservice Technorati

Zendservice Windowsazure

Referências · 37

• http://framework.zend.com/security/advisory/ZF2014-02 · Nota
• http://debian.org/security/2015/dsa-3265 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5657 · Nota de Segurança
• https://web.archive.org/web/20150523055201/http://mandriva.com/en/support/security/advisories/advisory/MDVSA-2014:072/?name=MDVSA-2014:072 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1081288 · Nota
• https://secunia.com/advisories/57276 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2014:072 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-2682 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6532 · Nota de Segurança
• http://framework.zend.com/security/advisory/ZF2014-01 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-3265-1 · Aviso do Fabricante