PT-2014-4870 · Zend · Zend Framework+1

Published 2014-04-03 · Updated 2017-11-04 · CVE-2014-2684

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zend Framework 1 versions prior to 1.12.4 ZendOpenId versions prior to 2.0.2

Description The issue allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimed id values. This is due to the failure of the GenericConsumer class and the Zend OpenId Consumer class to verify that the openid op endpoint value identifies the same Identity Provider as the provider used in the association handle.

Recommendations For Zend Framework 1 versions prior to 1.12.4, update to version 1.12.4 or later to resolve the issue. For ZendOpenId versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-2684

DLA-251-1

DSA-3265-1

DSA-3265-2

MGASA-2014-0151

Affected Products

Zend Framework

Zendopenid

References · 34

• http://framework.zend.com/security/advisory/ZF2014-02 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5657 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-2684 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2014:072 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6532 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3265-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3265-2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2683 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8089 · Security Note
• https://security-tracker.debian.org/tracker/source-package/zendframework · Vendor Advisory
• http://debian.org/security/2015/dsa-3265 · Vendor Advisory