what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Secunia Security Advisory 38127

Secunia Security Advisory 38127
Posted Jan 14, 2010
Authored by Secunia | Site secunia.com

Secunia Security Advisory - A weakness and some vulnerabilities have been reported in Zend Framework, which can be exploited by malicious people to bypass certain security restrictions and conduct script insertion or cross-site scripting attacks.

tags | advisory, vulnerability, xss
SHA-256 | 1232126119e2cdaa319f73ada9f50bd75233777b01e137a49582a8dd77463925

Secunia Security Advisory 38127

Change Mirror Download
----------------------------------------------------------------------



Accurate Vulnerability Scanning
No more false positives, no more false negatives

http://secunia.com/vulnerability_scanning/



----------------------------------------------------------------------

TITLE:
Zend Framework Cross-Site Scripting and Security Bypass
Vulnerabilities

SECUNIA ADVISORY ID:
SA38127

VERIFY ADVISORY:
http://secunia.com/advisories/38127/

DESCRIPTION:
A weakness and some vulnerabilities have been reported in Zend
Framework, which can be exploited by malicious people to bypass
certain security restrictions and conduct script insertion or
cross-site scripting attacks.

1) Inconsistent character encoding within e.g. the Zend_Form,
Zend_Filter, Zend_Form, Zend_Log, and Zend_View components can result
in the "htmlspecialchars()" and "htmlentities()" functions being
called with wrong character encoding settings. This can be exploited
to execute arbitrary HTML and script code in a user's browser session
in context of an affected site.

2) The Zend_Dojo_View_Helper_Editor component does not properly
decorate an HTML DIV, which can lead to certain input not being
properly sanitised. This can be exploited to execute arbitrary HTML
and script code in a user's browser session in context of an affected
site.

3) The Zend_Filter_StripTags component does not properly filter
certain input if HTML comments are whitelisted. This can be exploited
to execute arbitrary HTML and script code in a user's browser session
in context of an affected site.

Successful exploitation requires that the "allowComments"
functionality is enabled.

4) The weakness is caused due to the Zend_File_Transfer component
potentially relying on user-supplied MIME types when e.g. the
"ext/finfo" PHP extension is not available or the MIME type can not
be determined otherwise, potentially allowing for other attacks.

5) Input passed to the CAPTCHA's email argument of the
Zend_Service_ReCaptcha_MailHide component is not properly sanitised
before being used. This can be exploited to execute arbitrary HTML
and script code in a user's browser session in context of an affected
site.

6) The Zend_Json_Encoder component does not properly handle the "/"
character, which can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an affected
site.

SOLUTION:
Update to version 1.9.7 or later.
http://framework.zend.com/download/latest

Vulnerabilities #2, #3, #5 and #6 are also fixed in version 1.7.9,
1.8.5, and 1.9.7. Weakness #4 is also fixed in version 1.8.5 and
1.9.7.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1, 3, 4, 5, 6) Pádraic Brady.
2) Pádraic Brady, Peter Petrison, and Mark Corti

ORIGINAL ADVISORY:
http://devzone.zend.com/article/11622-Zend-Framework-1.9.7-1.8.5-and-1.7.9-Released
1) http://framework.zend.com/security/advisory/ZF2010-01
2) http://framework.zend.com/security/advisory/ZF2010-02
3) http://framework.zend.com/security/advisory/ZF2010-03
4) http://framework.zend.com/security/advisory/ZF2010-04
5) http://framework.zend.com/security/advisory/ZF2010-05
6) http://framework.zend.com/security/advisory/ZF2010-06

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Login or Register to add favorites

File Archive:

November 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    16 Files
  • 2
    Nov 2nd
    17 Files
  • 3
    Nov 3rd
    17 Files
  • 4
    Nov 4th
    11 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    3 Files
  • 8
    Nov 8th
    59 Files
  • 9
    Nov 9th
    12 Files
  • 10
    Nov 10th
    6 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    1 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    9 Files
  • 15
    Nov 15th
    33 Files
  • 16
    Nov 16th
    53 Files
  • 17
    Nov 17th
    11 Files
  • 18
    Nov 18th
    14 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    26 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    10 Files
  • 24
    Nov 24th
    9 Files
  • 25
    Nov 25th
    11 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close