PT-2006-5232 · Zend · Zend Platform

Stefan Esser · Published 2006-08-29 · Updated 2018-10-17 · CVE-2006-4431

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zend Platform versions 2.2.1 and earlier

Description The issue is related to multiple buffer overflows in the Session Clustering Daemon and the mod cluster module. This can be exploited by remote attackers who can cause a denial of service (crash) or execute arbitrary code via a crafted PHP session identifier (PHPSESSID), which can be either empty or specially crafted.

Recommendations For Zend Platform versions 2.2.1 and earlier, update to a version that contains a fix for this issue to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2006-4431

Affected Products

Zend Platform

References · 11

• http://vupen.com/english/advisories/2006/3388 · Vendor Advisory
• http://secunia.com/advisories/21573 · Vendor Advisory
• http://hardened-php.net/advisory_052006.128.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4431 · Security Note
• http://securityfocus.com/archive/1/444263/100/0/threaded · Note
• http://marc.info/?l=full-disclosure&m=115642248226217&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28573 · Note
• http://osvdb.org/28230 · Note
• http://osvdb.org/28231 · Note
• http://securityfocus.com/bid/19692 · Note
• http://securityreason.com/securityalert/1466 · Note