Bug 425452 – <dev-php/ZendFramework-1.11.12 : "Zend_XmlRpc" XML Entity References Information Disclosure Vulnerability (CVE-2012-3363)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2012-07-09 09:37:16 UTC]

From secunia security advisory at $URL:


Description
SEC Consult has reported a vulnerability in Zend Framework, which can be exploited by malicious people to disclose sensitive information.

The vulnerability is caused due to an error within the "Zend_XmlRpc" class when processing XML data, which can be exploited to e.g. disclose contents of certain local files by sending specially crafted XML data including external entity references.

The vulnerability is reported in versions prior to 1.11.12 and 1.12.0.


Solution
Update to version 1.11.12 or 1.12.0.

[Comment 1 Agostino Sarubbo 2012-07-09 09:37:54 UTC]

@maintainer: is ok to stabilize?

[Comment 2 Bjarke Istrup Pedersen (RETIRED) 2012-07-10 12:40:09 UTC]

Ok with me - please go ahead.

[Comment 3 Agostino Sarubbo 2012-07-10 18:23:34 UTC]

Thanks.


Arches, please test and mark stable:
=dev-php/ZendFramework-1.11.12
Target KEYWORDS : "amd64 hppa ppc ppc64 x86"

[Comment 4 Agostino Sarubbo 2012-07-10 19:56:56 UTC]

amd64 stable

[Comment 5 Jeff (JD) Horelick (RETIRED) 2012-07-11 00:20:32 UTC]

x86 stable

[Comment 6 Jeroen Roovers (RETIRED) 2012-07-11 16:38:21 UTC]

Stable for HPPA.

[Comment 7 Brent Baude (RETIRED) 2012-08-09 18:26:53 UTC]

ppc done

[Comment 8 Kacper Kowalik (Xarthisius) (RETIRED) 2012-09-20 13:02:34 UTC]

ppc/ppc64 keywords dropped

[Comment 9 Agostino Sarubbo 2012-09-20 13:08:06 UTC]

security please vote

[Comment 10 Sean Amoss (RETIRED) 2012-09-20 13:46:37 UTC]

(In reply to comment #9)
> security please vote

Yes, we know when to vote and we can do so with 1 less email if you would let us. 

GLSA vote: no.

[Comment 11 Agostino Sarubbo 2012-09-20 13:49:59 UTC]

(In reply to comment #10)
> Yes, we know when to vote and we can do so with 1 less email if you would
> let us. 

What is the difference for you between:
1)Change [stable] to [glsa?]
2)Change [stable] to [glsa?] and say: security please vote?


You will receive in both cases 1 email.

[Comment 12 Sean Amoss (RETIRED) 2012-09-20 13:54:53 UTC]

(In reply to comment #11)
> (In reply to comment #10)
> > Yes, we know when to vote and we can do so with 1 less email if you would
> > let us. 
> 
> What is the difference for you between:
> 1)Change [stable] to [glsa?]
> 2)Change [stable] to [glsa?] and say: security please vote?
> 
> 
> You will receive in both cases 1 email.

Two Email Method:
1. You change status from [stable] to [glsa?] and tell us to vote
2. We vote. 

One Email Method:
1. We change status from [stable] to [glsa?] and vote at the same time.

Which do method you think the people watching security@, CC'd to bugs, and assigned to the bug would prefer?

[Comment 13 Tim Sammut (RETIRED) 2012-09-20 23:26:41 UTC]

Thanks, folks. GLSA Vote: no, closing.

[Comment 14 GLSAMaker/CVETool Bot 2013-03-04 22:02:51 UTC]

CVE-2012-3363 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3363):
  Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0
  does not properly handle SimpleXMLElement classes, which allows remote
  attackers to read arbitrary files or create TCP connections via an external
  entity reference in a DOCTYPE element in an XML-RPC request, aka an XML
  external entity (XXE) injection attack.