Bug 1151276 (CVE-2014-8088)

Summary:	CVE-2014-8088 php-ZendFramework: null byte issue, connect to LDAP without knowing the password (ZF2014-05)
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fedora, felix, fweimer, jrusnack, mmcallis, shawn, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Zend Framework 1.12.9, Zend Framework 2.2.8, Zend Framework 2.3.3	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-01-03 15:44:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1151278, 1151279, 1151280, 1151281
Bug Blocks:

Description Murray McAllister 2014-10-10 03:08:20 UTC

The 1.12.9, 2.2.8, and 2.3.3 releases of the Zend Framework fix an issue regarding LDAP bind's and null bytes. For applications using the Zend Framework and PHP's ldap_bind, an attacker could use this flaw to log in as another user without knowing that user's password.

For the php-ZendFramework packages (not php-ZendFramework2) in Fedora 19 and 20, the fixed version is already in the testing repositories.

References:

http://framework.zend.com/security/advisory/ZF2014-05
http://framework.zend.com/blog/zend-framework-1-12-9-2-2-8-and-2-3-3-released.html

Comment 1 Murray McAllister 2014-10-10 03:12:38 UTC

Created php-ZendFramework2 tracking bugs for this issue:

Affects: fedora-all [bug 1151278]
Affects: epel-6 [bug 1151280]
Affects: epel-7 [bug 1151281]

Comment 2 Murray McAllister 2014-10-10 03:12:40 UTC

Created php-ZendFramework tracking bugs for this issue:

Affects: epel-6 [bug 1151279]

Comment 3 Murray McAllister 2014-10-10 03:21:47 UTC

CVE request: http://www.openwall.com/lists/oss-security/2014/10/10/2

Comment 4 Remi Collet 2014-10-10 09:36:58 UTC

Notice: Fedora is not affected by this bug which is fixed in PHP.

From official annoucement "This corrects for unpatched versions of PHP (versions 5.5.11 and below, 5.4.27 and below, and any prior releases)."

Comment 5 Fedora Update System 2014-10-16 02:00:13 UTC

php-ZendFramework2-2.3.3-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2014-10-17 08:37:21 UTC

php-ZendFramework-1.12.9-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2014-10-17 08:42:20 UTC

php-ZendFramework-1.12.9-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2014-10-28 06:44:56 UTC

php-ZendFramework2-2.3.3-2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2014-10-28 11:01:34 UTC

php-ZendFramework-1.12.9-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2014-10-28 11:02:55 UTC

php-ZendFramework2-2.3.3-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2014-11-01 16:20:04 UTC

php-ZendFramework-1.12.9-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2014-11-10 06:49:19 UTC

php-ZendFramework2-2.2.8-2.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2014-11-16 04:15:20 UTC

php-ZendFramework2-2.2.8-2.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 14 Shawn Iwinski 2015-01-03 05:09:03 UTC

All dependent bugs have been addressed and are closed.  Can this bug be closed?

Comment 15 Felix Kaechele 2015-01-03 15:44:27 UTC

Thanks for the hint!