Info

Last Modified

7 months ago

Percent Complete

100%

Disclosure

Jan 26, 2007

Discovery

Unknown

Dates

Exploit

Mar 03, 2007

Solution

Unknown

Description

Zend Platform contains a flaw that may allow for local privilege escalation. The flaw is due to insecure default permissions set on multiple scripts and executables that are run when the application is started. The issue is triggered when a user directly edits one of the vulnerable files, for example, /usr/local/Zend/bin/scd.sh, the startup script for the Zend session management daemon, and inserts commands into the script. These commands will be executed with root permissions upon server restart resulting in a loss of confidentiality, integrity, and/or availability.

Classification

Location: Local Access Required
Attack Type: Misconfiguration
Impact: Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified

Technical

This vulnerability occurs only when safe_mode and open_basedir are disabled.

Solution

Upgrade to version 3.0 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround(s): Run the following commands (note that 'Platform_install_dir' is by default: /usr/local/Zend):
chown -R root Platform_install_dir/bin
chmod -R 755 Platform_install_dir/bin
chown -R root Platform_install_dir/sbin
chmod -R 755 Platform_install_dir/sbin
chmod 2755 Platform_install_dir/sbin/ini_modifier
chown -R root Platform_install_dir/lib
chmod -R 755 Platform_install_dir/lib