Zend Server Java Bridge 'javamw.jar' Service Remote Code Execution Vulnerability

Bugtraq ID:	47060
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 28 2011 12:00AM
Updated:	Apr 06 2011 04:55AM
Credit:	Luca Carettoni
Vulnerable:	Zend Zend Server 0
Not Vulnerable:

Zend Server Java Bridge 'javamw.jar' Service Remote Code Execution Vulnerability

Zend Server is prone to a remote code-execution vulnerability in the Zend Java Bridge component.

Successful exploits can allow the attacker to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition.

Zend Server Java Bridge 'javamw.jar' Service Remote Code Execution Vulnerability

The following exploit codes are available:

• /data/vulnerabilities/exploits/47060.java
• /data/vulnerabilities/exploits/47060-1.java

Zend Server Java Bridge 'javamw.jar' Service Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the reference for more details.

Zend Server Java Bridge 'javamw.jar' Service Remote Code Execution Vulnerability

References:

• ZDI-11-113 Zend Server Java Bridge Design Flaw Remote Code Execution Vulnerabili (TippingPoint Zero Day Initiative)
  
• Zend Server Homepage (Zend)
  
• ZDI-11-113: Zend Server Java Bridge Design Flaw Remote Code Execution Vulnerabi (ZDI Disclosures )
  
• Zend Server Release History (Zend)