PT-2014-4869 · Zend · Zendservice Nirvanix+10

Publicado 2014-04-03 · Atualizado 2022-05-14 · CVE-2014-2683

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Zend Framework 1 versions 1.12.3 and earlier Zend Framework 2 versions 2.1.5 and earlier, 2.2.x versions 2.2.5 and earlier ZendOpenId version 2.0.1 and earlier ZendRest version 2.0.1 and earlier ZendService AudioScrobbler version 2.0.1 and earlier ZendService Nirvanix version 2.0.1 and earlier ZendService SlideShare version 2.0.1 and earlier ZendService Technorati version 2.0.1 and earlier ZendService WindowsAzure version 2.0.1 and earlier ZendService Amazon version 2.0.2 and earlier ZendService Api version 1.0.0 and earlier

Description The issue allows remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration, also known as an XML Entity Expansion (XEE) attack.

Recommendations Update to Zend Framework 1 version 1.12.4 or later Update to Zend Framework 2 version 2.1.6 or later, or 2.2.x version 2.2.6 or later Update to ZendOpenId version 2.0.2 or later Update to ZendRest version 2.0.2 or later Update to ZendService AudioScrobbler version 2.0.2 or later Update to ZendService Nirvanix version 2.0.2 or later Update to ZendService SlideShare version 2.0.2 or later Update to ZendService Technorati version 2.0.2 or later Update to ZendService WindowsAzure version 2.0.2 or later Update to ZendService Amazon version 2.0.3 or later Update to ZendService Api version 1.0.0 or later

Correção

DoS

XML Entity Expansion

XXE

Enumeração de Fraquezas

CWE-17

CWE-776

CWE-611

Identificadores relacionados

CVE-2014-2683

DLA-251-1

DSA-3265-1

DSA-3265-2

GHSA-5WM2-38Q5-5RXV

MGASA-2014-0151

Produtos afetados

Zend Framework 1

Zend Framework 2

Zendopenid

Zendrest

Zendservice Amazon

Zendservice Api

Zendservice Audioscrobbler

Zendservice Nirvanix

Zendservice Slideshare

Zendservice Technorati

Zendservice Windowsazure

Referências · 37

• http://framework.zend.com/security/advisory/ZF2014-02 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5657 · Nota de Segurança
• http://debian.org/security/2015/dsa-3265 · Aviso do Fabricante
• https://web.archive.org/web/20150523055201/http://mandriva.com/en/support/security/advisories/advisory/MDVSA-2014:072/?name=MDVSA-2014:072 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1081288 · Nota
• https://secunia.com/advisories/57276 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2014:072 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-5wm2-38q5-5rxv · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6532 · Nota de Segurança
• http://framework.zend.com/security/advisory/ZF2014-01 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-3265-1 · Aviso do Fabricante