Zend Framework 'zend _ feed' component information leakage Vulnerability

Release date:
Updated on:

Affected Systems:
Zend Framework 1.11.6
Zend Framework 1.11.4
Zend Framework 1.11.3
Zend Framework 1.10.9
Zend Framework 1.10.4
Zend Framework 1.10.3
Zend Framework 1.10.2
Description:
--------------------------------------------------------------------------------
Bugtraq id: 56982

Zend Framework (ZF) is an open-source PHP5 development Framework that can be used to develop web programs and services.

The Zend_Feed_Rss and Zend_Feed_Atom classes in earlier versions of Zend Framework 1.11.15 and 1.12.1 have vulnerabilities in xml data processing by Using Insecure php dom extensions, attackers can exploit this vulnerability to open arbitrary files by sending specially crafted XML data that contains external entity references, resulting in local file information leakage.

<* Source: Yury Dyachenko

Link: http://secunia.com/advisories/51583/
Http://framework.zend.com/security/advisory/ZF2012-05
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Zend
----
Zend has released a Security Bulletin (ZF2012-05) and corresponding patches for this:

ZF2012-05: ZF2012-05: Potential XML eXternal Entity injection vectors in Zend Framework 1 Zend_Feed component

Link: http://framework.zend.com/security/advisory/ZF2012-05