Zend Server Java Bridge Arbitrary Java Code Execution

critical Nessus Plugin ID 53533

Language:

Synopsis

The remote service has a code execution vulnerability.

Description

Zend Server Java Bridge, a service that lets PHP applications use Java code, has an arbitrary code execution vulnerability. The service accepts requests to execute Java code without authentication.

A remote, unauthenticated attacker could exploit this to execute arbitrary Java code.

Solution

Apply the hofix provided by the vendor.

If the hotfix is already applied, ensure access to the service is restricted using the 'zend.javamw.ip' system property.

Plugin Details

Severity: Critical

ID: 53533

File Name: zend_server_java_bridge_code_exec.nasl

Version: 1.11

Type: Remote

Family: Misc.

Published: 4/22/2011

Updated: 11/15/2018

Supported Sensors: Nessus

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 3/24/2011

Vulnerability Publication Date: 3/24/2011

Exploitable With

Metasploit (Zend Server Java Bridge Arbitrary Java Code Execution)

Reference Information

BID: 47060

Detections

Analytics