Executive Summary

Informations
Name MDVSA-2014:072 First vendor Publication 2014-04-09
Vendor Mandriva Last vendor Modification 2014-04-09
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Updated php-ZendFramework packages fix security vulnerabilities:

XML eXternal Entity (XXE) and XML Entity Expansion (XEE) flaws were discovered in the Zend Framework. An attacker could use these flaws to cause a denial of service, access files accessible to the server process, or possibly perform other more advanced XML External Entity (XXE) attacks (CVE-2014-2681, CVE-2014-2682, CVE-2014-2683).

Using the Consumer component of Zend_OpenId, it is possible to login using an arbitrary OpenID account (without knowing any secret information) by using a malicious OpenID Provider. That means OpenID it is possible to login using arbitrary OpenID Identity (MyOpenID, Google, etc), which are not under the control of our own OpenID Provider. Thus, we are able to impersonate any OpenID Identity against the framework (CVE-2014-2684, CVE-2014-2685).

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2014:072

CWE : Common Weakness Enumeration

% Id Name
40 % CWE-19 Data Handling
20 % CWE-287 Improper Authentication
20 % CWE-264 Permissions, Privileges, and Access Controls
20 % CWE-17 Code

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 143
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1

Nessus® Vulnerability Scanner

Date Description
2015-06-22 Name : The remote Debian host is missing a security update.
File : debian_DLA-251.nasl - Type : ACT_GATHER_INFO
2015-05-21 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3265.nasl - Type : ACT_GATHER_INFO
2015-03-30 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2015-097.nasl - Type : ACT_GATHER_INFO
2014-10-12 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-377.nasl - Type : ACT_GATHER_INFO
2014-04-15 Name : The remote Fedora host is missing a security update.
File : fedora_2014-4603.nasl - Type : ACT_GATHER_INFO
2014-04-15 Name : The remote Fedora host is missing a security update.
File : fedora_2014-4612.nasl - Type : ACT_GATHER_INFO
2014-04-15 Name : The remote Fedora host is missing a security update.
File : fedora_2014-4636.nasl - Type : ACT_GATHER_INFO
2014-04-15 Name : The remote Fedora host is missing a security update.
File : fedora_2014-4651.nasl - Type : ACT_GATHER_INFO
2014-04-10 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-072.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
Date Informations
2014-11-16 05:39:35
  • Multiple Updates
2014-09-05 21:27:38
  • Multiple Updates
2014-09-05 17:25:09
  • Multiple Updates
2014-09-04 21:27:16
  • Multiple Updates
2014-04-11 13:22:04
  • Multiple Updates
2014-04-10 13:20:55
  • First insertion