CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.

Versions of Zend Framework earlier than 2.3.8, or 2.4.x earlier than 2.4.1 are vulnerable to a flaw in the 'Zend\Mail' and 'Zend\Http' components that is triggered as CRLF (Carriage Return and Line Feed) character sequences are not properly sanitized before being included in responses.  This allows a context-dependent attacker to inject additional headers into responses to conduct HTTP response splitting attacks.

Upstream reported a vulnerability in the Zend\Mail component in Zend Framework 2, specifically in how it handles headers. Headers are not correctly filtered for newlines, allowing the ability to send additional, unrelated headers and to bypass additional headers by emitting the header/body separator sequence.

The previous zendframework upload incorrectly fixes CVE-2015-3154, causing a regression. This update corrects this problem. Thanks to &#x415;&#x432;&#x433;&#x435;&#x43D;&#x438;&#x439;
&#x421;&#x43C;&#x43E;&#x43B;&#x438;&#x43D; (Evgeny Smolin) <esmolin@inbox.ru>.

CVE-2012-6531

P&aacute;draic Brady identified a weakness to handle the SimpleXMLElement zendframework class, allowing to remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack.

CVE-2012-6532

P&aacute;draic Brady found that remote attackers could cause a denial of service by CPU consumption, via recursive or circular references through an XML entity expansion (XEE) attack.

CVE-2014-2681

Lukas Reschke reported a lack of protection against XML External Entity injection attacks in some functions. This fix extends the incomplete one from CVE-2012-5657.

CVE-2014-2682

Lukas Reschke reported a failure to consider that the libxml_disable_entity_loader setting is shared among threads in the PHP-FPM case. This fix extends the incomplete one from CVE-2012-5657.

CVE-2014-2683

Lukas Reschke reported a lack of protection against XML Entity Expansion attacks in some functions. This fix extends the incomplete one from CVE-2012-6532.

CVE-2014-2684

Christian Mainka and Vladislav Mladenov from the Ruhr-University Bochum reported an error in the consumer's verify method that lead to acceptance of wrongly sourced tokens.

CVE-2014-2685

Christian Mainka and Vladislav Mladenov from the Ruhr-University Bochum reported a specification violation in which signing of a single parameter is incorrectly considered sufficient.

CVE-2014-4914

Cassiano Dal Pizzol discovered that the implementation of the ORDER BY SQL statement in Zend_Db_Select contains a potential SQL injection when the query string passed contains parentheses.

CVE-2014-8088

Yury Dyachenko at Positive Research Center identified potential XML eXternal Entity injection vectors due to insecure usage of PHP's DOM extension.

CVE-2014-8089

Jonas Sandstr&ouml;m discovered a SQL injection vector when manually quoting value for sqlsrv extension, using null byte.

CVE-2015-3154

Filippo Tessarotto and Maks3w reported potential CRLF injection attacks in mail and HTTP headers.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**Zend Framework 1.12.13**

  - 567: Cast int and float to string when creating headers

**Zend Framework 1.12.12**

  - 493: PHPUnit not being installed

    - 511: Add PATCH to the list of allowed methods in       Zend_Controller_Request_HttpTestCase

    - 513: Save time and space when cloning PHPUnit

    - 515: !IE conditional comments bug

    - 516: Zend_Locale does not honor parentLocale       configuration

    - 518: Run travis build also on PHP 7 builds

    - 534: Failing unit test:
      Zend_Validate_EmailAddressTest::testIdnHostnameInEmail       lAddress

    - 536: Zend_Measure_Number convert some decimal numbers       to roman with space char

    - 537: Extend view renderer controller fix (#440)

    - 540: Fix PHP 7 BC breaks in Zend_XmlRpc/Amf_Server

    - 541: Fixed errors in tests on PHP7

    - 542: Correctly reset the sub-path when processing       routes

    - 545: Fixed path delimeters being stripped by chain       routes affecting later routes

    - 546: TravisCI: Skip memcache(d) on PHP 5.2

    - 547: Session Validators throw 'general' Session       Exception during Session start

    - 550: Notice 'Undefined index: browser_version'

    - 557: doc: Zend Framework Dependencies table unreadable

    - 559: Fixes a typo in Zend_Validate messages for SK

    - 561: Zend_Date not expected year

    - 564: Zend_Application tries to load       ZendX_Application_Resource_FrontController during       instantiation

**Security**

  - **ZF2015-04**: Zend_Mail and Zend_Http were both     susceptible to CRLF Injection Attack vectors (for HTTP,     this is often referred to as HTTP Response Splitting).
    Both components were updated to perform header value     validations to ensure no values contain characters not     detailed in their corresponding specifications, and will     raise exceptions on detection. Each also provides new     facilities for both validating and filtering header     values prior to injecting them into header classes. If     you use either Zend_Mail or Zend_Http, we recommend     upgrading immediately.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities were discovered in Zend Framework, a PHP framework. Except for CVE-2015-3154, all these issues were already fixed in the version initially shipped with Jessie.

  - CVE-2014-2681     Lukas Reschke reported a lack of protection against XML     External Entity injection attacks in some functions.
    This fix extends the incomplete one from CVE-2012-5657.

  - CVE-2014-2682     Lukas Reschke reported a failure to consider that the     libxml_disable_entity_loader setting is shared among     threads in the PHP-FPM case. This fix extends the     incomplete one from CVE-2012-5657.

  - CVE-2014-2683     Lukas Reschke reported a lack of protection against XML     Entity Expansion attacks in some functions. This fix     extends the incomplete one from CVE-2012-6532.

  - CVE-2014-2684     Christian Mainka and Vladislav Mladenov from the     Ruhr-University Bochum reported an error in the     consumer's verify method that lead to acceptance of     wrongly sourced tokens.

  - CVE-2014-2685     Christian Mainka and Vladislav Mladenov from the     Ruhr-University Bochum reported a specification     violation in which signing of a single parameter is     incorrectly considered sufficient.

  - CVE-2014-4914     Cassiano Dal Pizzol discovered that the implementation     of the ORDER BY SQL statement in Zend_Db_Select contains     a potential SQL injection when the query string passed     contains parentheses.

  - CVE-2014-8088     Yury Dyachenko at Positive Research Center identified     potential XML eXternal Entity injection vectors due to     insecure usage of PHP's DOM extension.

  - CVE-2014-8089     Jonas Sandstrom discovered a SQL injection vector when     manually quoting value for sqlsrv extension, using null     byte.

  - CVE-2015-3154     Filippo Tessarotto and Maks3w reported potential CRLF     injection attacks in mail and HTTP headers.

ID	Name	Product	Family	Severity
9138	Zend Framework < 2.3.8 / 2.4.x < 2.4.1 HTTP Response Splitting	Nessus Network Monitor	CGI	medium
84596	Amazon Linux AMI : php-ZendFramework (ALAS-2015-560)	Nessus	Amazon Linux Local Security Checks	medium
84297	Debian DLA-251-2 : zendframework regression update	Nessus	Debian Local Security Checks	critical
83934	Fedora 20 : php-ZendFramework-1.12.13-1.fc20 (2015-8714)	Nessus	Fedora Local Security Checks	medium
83933	Fedora 21 : php-ZendFramework-1.12.13-1.fc21 (2015-8710)	Nessus	Fedora Local Security Checks	medium
83932	Fedora 22 : php-ZendFramework-1.12.13-1.fc22 (2015-8704)	Nessus	Fedora Local Security Checks	medium
83748	Debian DSA-3265-1 : zendframework - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2015-3154

medium

Tenable Plugins

medium

medium

critical

medium

medium

medium

critical