----------------------------------------------------------------------



Accurate Vulnerability Scanning
No more false positives, no more false negatives

http://secunia.com/vulnerability_scanning/



----------------------------------------------------------------------

TITLE:
Zend Framework Cross-Site Scripting and Security Bypass
Vulnerabilities

SECUNIA ADVISORY ID:
SA38127

VERIFY ADVISORY:
http://secunia.com/advisories/38127/

DESCRIPTION:
A weakness and some vulnerabilities have been reported in Zend
Framework, which can be exploited by malicious people to bypass
certain security restrictions and conduct script insertion or
cross-site scripting attacks.

1) Inconsistent character encoding within e.g. the Zend_Form,
Zend_Filter, Zend_Form, Zend_Log, and Zend_View components can result
in the "htmlspecialchars()" and "htmlentities()" functions being
called with wrong character encoding settings. This can be exploited
to execute arbitrary HTML and script code in a user's browser session
in context of an affected site.

2) The Zend_Dojo_View_Helper_Editor component does not properly
decorate an HTML DIV, which can lead to certain input not being
properly sanitised. This can be exploited to execute arbitrary HTML
and script code in a user's browser session in context of an affected
site.

3) The Zend_Filter_StripTags component does not properly filter
certain input if HTML comments are whitelisted. This can be exploited
to execute arbitrary HTML and script code in a user's browser session
in context of an affected site.

Successful exploitation requires that the "allowComments"
functionality is enabled.

4) The weakness is caused due to the Zend_File_Transfer component
potentially relying on user-supplied MIME types when e.g. the
"ext/finfo" PHP extension is not available or the MIME type can not
be determined otherwise, potentially allowing for other attacks.

5) Input passed to the CAPTCHA's email argument of the
Zend_Service_ReCaptcha_MailHide component is not properly sanitised
before being used. This can be exploited to execute arbitrary HTML
and script code in a user's browser session in context of an affected
site.

6) The Zend_Json_Encoder component does not properly handle the "/"
character, which can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an affected
site.

SOLUTION:
Update to version 1.9.7 or later.
http://framework.zend.com/download/latest

Vulnerabilities #2, #3, #5 and #6 are also fixed in version 1.7.9,
1.8.5, and 1.9.7. Weakness #4 is also fixed in version 1.8.5 and
1.9.7.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1, 3, 4, 5, 6) Pádraic Brady.
2) Pádraic Brady, Peter Petrison, and Mark Corti

ORIGINAL ADVISORY:
http://devzone.zend.com/article/11622-Zend-Framework-1.9.7-1.8.5-and-1.7.9-Released
1) http://framework.zend.com/security/advisory/ZF2010-01
2) http://framework.zend.com/security/advisory/ZF2010-02
3) http://framework.zend.com/security/advisory/ZF2010-03
4) http://framework.zend.com/security/advisory/ZF2010-04
5) http://framework.zend.com/security/advisory/ZF2010-05
6) http://framework.zend.com/security/advisory/ZF2010-06

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------