Zend Framework < 2.2.9 / 2.3.x < 2.3.4 Session Validators Security Bypass

Medium Nessus Network Monitor Plugin ID 9141

Synopsis

The remote host is using a version of Zend Framework that is vulnerable to a security bypass flaw.

Description

Versions of Zend Framework earlier than 2.2.9, or 2.3.x earlier than 2.3.4 are vulnerable to a security bypass flaw in which session validators are not run if set before session start. Specifically, the validators write to the '$_SESSION' superglobal variable before session start, resulting in data being overwritten once a session begins. On subsequent calls, the validators have no data against which to compare, making the sessions automatically valid. Patched versions ensure that validators are run only after the session has begun, and thus validate sessions correctly.

Solution

Upgrade Zend Framework to version 2.3.4 or later. If version 2.3.x is not available, version 2.2.9 is also patched for this vulnerability.

See Also

http://framework.zend.com

http://framework.zend.com/changelog/2.3.4

Plugin Details

Severity: Medium

ID: 9141

Family: CGI

Published: 2016/03/15

Modified: 2016/03/15

Dependencies: 9135

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSSv3

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS3#E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:thomas_breuss:zend_framework_integration_zend_framework

Patch Publication Date: 2015/01/14

Vulnerability Publication Date: 2015/01/01

Reference Information

BID: 72270