vendor:
Zend Server
by:
Luca Carettoni
9
CVSS
CRITICAL
Remote Code Execution
502
CWE
Product Name: Zend Server
Affected Version From: Zend Server v5.0.2, Zend Server Community Edition v5.0.2 and previous releases
Affected Version To: Zend Server v5.0.2, Zend Server Community Edition v5.0.2 and previous releases
Patch Exists: YES
Related CWE: CVE-2011-1675
CPE: a:zend:zend_server:5.0.2
Metasploit:
https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2012-0168/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2011-1691/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2012-0307/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2011-1675/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2011-0406/
Platforms Tested: Windows, Linux, Mac OS X and IBM i
2010
Zend Java Bridge v3.1 – Remote Code Execution (ZDI-11-113)
The Zend Java Bridge component in Zend Server v5.0.2, Zend Server Community Edition v5.0.2, and previous releases allows remote attackers to execute arbitrary Java code via a crafted serialized Java object, related to the Java Class Library (JCL) and Java Reflection.
Mitigation:
Upgrade to Zend Server v5.0.3 or later.
