PT-2014-4868 · Zend+1 · Zendservice Nirvanix+11

Published 2014-04-03 · Updated 2022-05-14 · CVE-2014-2682

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zend Framework 1 versions 1.12.3 and earlier Zend Framework 2 versions 2.1.5 and earlier, 2.2.x versions 2.2.5 and earlier ZendOpenId version 2.0.1 and earlier ZendRest version 2.0.1 and earlier ZendService AudioScrobbler version 2.0.1 and earlier ZendService Nirvanix version 2.0.1 and earlier ZendService SlideShare version 2.0.1 and earlier ZendService Technorati version 2.0.1 and earlier ZendService WindowsAzure version 2.0.1 and earlier ZendService Amazon version 2.0.2 and earlier ZendService Api version 0.9.9 and earlier

Description The issue is related to the improper sharing of the libxml disable entity loader setting between threads when PHP-FPM is used. This might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference.

Recommendations For Zend Framework 1 versions 1.12.3 and earlier, update to version 1.12.4 or later. For Zend Framework 2 versions 2.1.5 and earlier, update to version 2.1.6 or later. For Zend Framework 2 versions 2.2.x 2.2.5 and earlier, update to version 2.2.6 or later. For ZendOpenId version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendRest version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService AudioScrobbler version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService Nirvanix version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService SlideShare version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService Technorati version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService WindowsAzure version 2.0.1 and earlier, update to version 2.0.2 or later. For ZendService Amazon version 2.0.2 and earlier, update to version 2.0.3 or later. For ZendService Api version 0.9.9 and earlier, update to version 1.0.0 or later.

Fix

XML Entity Expansion

XXE

Weakness Enumeration

CWE-776

CWE-19

CWE-611

Related Identifiers

CVE-2014-2682

DLA-251-1

DSA-3265-1

DSA-3265-2

GHSA-GP39-H9C2-QW79

MGASA-2014-0151

Affected Products

Php-Fpm

Zend Framework 1

Zend Framework 2

Zendopenid

Zendrest

Zendservice Amazon

Zendservice Api

Zendservice Audioscrobbler

Zendservice Nirvanix

Zendservice Slideshare

Zendservice Technorati

Zendservice Windowsazure

References · 37

• http://debian.org/security/2015/dsa-3265 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5657 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2014:072 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-2682 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6532 · Security Note
• http://framework.zend.com/security/advisory/ZF2014-01 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3265-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3265-2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2683 · Security Note
• https://osv.dev/vulnerability/GHSA-gp39-h9c2-qw79 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8089 · Security Note