Detections
Analytics

Mandriva Linux Security Advisory : php-ZendFramework (MDVSA-2014:216)

medium Nessus Plugin ID 79366

Language:

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

A vulnerability has been found and corrected in php-ZendFramework :

The (1) Zend_Ldap class in Zend before 1.12.9 and (2) Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind (CVE-2014-8088).

The updated packages have been upgraded to the latest ZendFramework (1.12.9) version which is not vulnerable to this issue.

Solution

Update the affected packages.

See Also

http://framework.zend.com/security/advisory/ZF2014-05

http://framework.zend.com/security/advisory/ZF2014-06

Plugin Details

Severity: Medium

ID: 79366

File Name: mandriva_MDVSA-2014-216.nasl

Version: 1.5

Type: local

Published: 11/21/2014

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.7

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:php-zendframework, p-cpe:/a:mandriva:linux:php-zendframework-cache-backend-apc, p-cpe:/a:mandriva:linux:php-zendframework-cache-backend-memcached, p-cpe:/a:mandriva:linux:php-zendframework-captcha, p-cpe:/a:mandriva:linux:php-zendframework-dojo, p-cpe:/a:mandriva:linux:php-zendframework-feed, p-cpe:/a:mandriva:linux:php-zendframework-gdata, p-cpe:/a:mandriva:linux:php-zendframework-pdf, p-cpe:/a:mandriva:linux:php-zendframework-search-lucene, p-cpe:/a:mandriva:linux:php-zendframework-services, p-cpe:/a:mandriva:linux:php-zendframework-demos, p-cpe:/a:mandriva:linux:php-zendframework-extras, p-cpe:/a:mandriva:linux:php-zendframework-tests, cpe:/o:mandriva:business_server:1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/20/2014

Reference Information

CVE: CVE-2014-8088

BID: 70378

MDVSA: 2014:216