PT-2012-5964 · Zend · Zend Server

Published 2012-10-11 · Updated 2024-08-06 · CVE-2012-5382

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zend Server version 5.6.0 SP4

Description The installation functionality in Zend Server has an untrusted search path vulnerability when installed in the top-level C: directory. This might allow local users to gain privileges via a Trojan horse DLL in the C:ZendZendServershareZendFrameworkbin directory, which may be added to the PATH system environment variable by an administrator. A demonstration of this issue involves a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in various Windows versions.

Recommendations For Zend Server version 5.6.0 SP4, consider avoiding the installation in the top-level C: directory to prevent the addition of the vulnerable directory to the PATH system environment variable. As a temporary workaround, restrict access to the C:ZendZendServershareZendFrameworkbin directory to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2012-5382

Affected Products

Zend Server

References · 6

• 🔥 https://htbridge.com/advisory/HTB23108 · Exploit
• 🔥 https://exploit-db.com/exploits/28130 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5382 · Security Note
• https://t.me/cvenotify/89524 · Telegram Post
• http://osvdb.org/86174 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5382 · Note