Zend Framework 'Zend_Feed' Component Information Disclosure Vulnerabilities

Bugtraq ID:	56982
Class:	Design Error
CVE:	CVE-2012-5657
Remote:	Yes
Local:	No
Published:	Dec 19 2012 12:00AM
Updated:	Apr 13 2015 09:55PM
Credit:	Yury Dyachenko at Positive Research Center
Vulnerable:	Zend Zend Framework 1.12 Zend Zend Framework 1.11.12 Zend Zend Framework 1.11.6 Zend Zend Framework 1.11.4 Zend Zend Framework 1.11.3 Zend Zend Framework 1.10.9 Zend Zend Framework 1.10.4 Zend Zend Framework 1.10.3 Zend Zend Framework 1.10.2 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	Zend Zend Framework 1.12.1 Zend Zend Framework 1.11.15

Zend Framework 'Zend_Feed' Component Information Disclosure Vulnerabilities

Zend Framework is prone to multiple information-disclosure vulnerabilities.

Successful exploit of these issues allows an attacker to gain access to certain local files. Information obtained may aid in further attacks.

Zend Framework versions prior to 1.11.15 and 1.12.1 are vulnerable.

Zend Framework 'Zend_Feed' Component Information Disclosure Vulnerabilities

Attackers can use readily available tools to exploit these issues.

Zend Framework 'Zend_Feed' Component Information Disclosure Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


Mandriva Business Server 1 X86 64

• Mandriva php-ZendFramework-1.12.1-1.1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-ZendFramework-Cache-Backend-Apc-1.12.1-1.1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-ZendFramework-Cache-Backend-Memcached-1.12.1-1.1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-ZendFramework-Captcha-1.12.1-1.1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-ZendFramework-demos-1.12.1-1.1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-ZendFramework-Dojo-1.12.1-1.1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-ZendFramework-extras-1.12.1-1.1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-ZendFramework-Feed-1.12.1-1.1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-ZendFramework-Gdata-1.12.1-1.1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-ZendFramework-Pdf-1.12.1-1.1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-ZendFramework-Search-Lucene-1.12.1-1.1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-ZendFramework-Services-1.12.1-1.1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva php-ZendFramework-tests-1.12.1-1.1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/

Zend Framework 'Zend_Feed' Component Information Disclosure Vulnerabilities

References:

• Zend Framework Homepage (Zend)
  
• ZF2012-05: Potential XML eXternal Entity injection vectors in Zend Framework 1 Z (Zend)