PT-2014-4867 · Zend · Zendservice Nirvanix+10

Lukas Reschke · Published 2014-04-03 · Updated 2022-05-14 · CVE-2014-2681

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Zend Framework 1 versions 1.12.3 and earlier Zend Framework 2 versions 2.1.5 and earlier, 2.2.x versions 2.2.5 and earlier ZendOpenId version 2.0.1 and earlier ZendRest version 2.0.1 and earlier ZendService AudioScrobbler version 2.0.1 and earlier ZendService Nirvanix version 2.0.1 and earlier ZendService SlideShare version 2.0.1 and earlier ZendService Technorati version 2.0.1 and earlier ZendService WindowsAzure version 2.0.1 and earlier ZendService Amazon version 2.0.2 and earlier ZendService Api version 0.9.9 and earlier

Description The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service via an XML External Entity (XXE) attack. This occurs due to an incomplete fix for a previous issue.

Recommendations For Zend Framework 1 versions 1.12.3 and earlier, update to version 1.12.4 or later. For Zend Framework 2 versions 2.1.5 and earlier, update to version 2.1.6 or later. For Zend Framework 2 versions 2.2.x 2.2.5 and earlier, update to version 2.2.6 or later. For ZendOpenId version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendRest version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService AudioScrobbler version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService Nirvanix version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService SlideShare version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService Technorati version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService WindowsAzure version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService Amazon version 2.0.2 and earlier, update to version 2.0.3 or later. For ZendService Api version 0.9.9 and earlier, update to version 1.0.0 or later.

Fix

DoS

XXE

Weakness Enumeration

CWE-19

CWE-611

Related Identifiers

CVE-2014-2681

DLA-251-1

DSA-3265-1

DSA-3265-2

GHSA-43XG-87XW-JPV8

MGASA-2014-0151

Affected Products

Zend Framework 1

Zend Framework 2

Zendopenid

Zendrest

Zendservice Amazon

Zendservice Api

Zendservice Audioscrobbler

Zendservice Nirvanix

Zendservice Slideshare

Zendservice Technorati

Zendservice Windowsazure

References · 37

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5657 · Security Note
• http://debian.org/security/2015/dsa-3265 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-43xg-87xw-jpv8 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-2681 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2014:072 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6532 · Security Note
• http://framework.zend.com/security/advisory/ZF2014-01 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3265-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3265-2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2683 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8089 · Security Note