---------------------------------------------------------------------- Accurate Vulnerability Scanning No more false positives, no more false negatives http://secunia.com/vulnerability_scanning/ ---------------------------------------------------------------------- TITLE: Zend Framework Cross-Site Scripting and Security Bypass Vulnerabilities SECUNIA ADVISORY ID: SA38127 VERIFY ADVISORY: http://secunia.com/advisories/38127/ DESCRIPTION: A weakness and some vulnerabilities have been reported in Zend Framework, which can be exploited by malicious people to bypass certain security restrictions and conduct script insertion or cross-site scripting attacks. 1) Inconsistent character encoding within e.g. the Zend_Form, Zend_Filter, Zend_Form, Zend_Log, and Zend_View components can result in the "htmlspecialchars()" and "htmlentities()" functions being called with wrong character encoding settings. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. 2) The Zend_Dojo_View_Helper_Editor component does not properly decorate an HTML DIV, which can lead to certain input not being properly sanitised. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. 3) The Zend_Filter_StripTags component does not properly filter certain input if HTML comments are whitelisted. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Successful exploitation requires that the "allowComments" functionality is enabled. 4) The weakness is caused due to the Zend_File_Transfer component potentially relying on user-supplied MIME types when e.g. the "ext/finfo" PHP extension is not available or the MIME type can not be determined otherwise, potentially allowing for other attacks. 5) Input passed to the CAPTCHA's email argument of the Zend_Service_ReCaptcha_MailHide component is not properly sanitised before being used. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. 6) The Zend_Json_Encoder component does not properly handle the "/" character, which can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. SOLUTION: Update to version 1.9.7 or later. http://framework.zend.com/download/latest Vulnerabilities #2, #3, #5 and #6 are also fixed in version 1.7.9, 1.8.5, and 1.9.7. Weakness #4 is also fixed in version 1.8.5 and 1.9.7. PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1, 3, 4, 5, 6) Pádraic Brady. 2) Pádraic Brady, Peter Petrison, and Mark Corti ORIGINAL ADVISORY: http://devzone.zend.com/article/11622-Zend-Framework-1.9.7-1.8.5-and-1.7.9-Released 1) http://framework.zend.com/security/advisory/ZF2010-01 2) http://framework.zend.com/security/advisory/ZF2010-02 3) http://framework.zend.com/security/advisory/ZF2010-03 4) http://framework.zend.com/security/advisory/ZF2010-04 5) http://framework.zend.com/security/advisory/ZF2010-05 6) http://framework.zend.com/security/advisory/ZF2010-06 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------