← Advisories

Zend Optimizer 3.3.3 (Windows) Insecure Permissions

Low
Advisory ID
ZSL-2012-5083
Release Date
03 April 2012
Vendor
Zend Technologies Ltd. - http://www.zend.com
Affected Version
3.3.3* and 3.3.0*, * Note: The patch did not change the version number of the affected product, so the updated version is still 3.3.3, but with proper permissions.
CVE
N/A
Tested On
Microsoft Windows XP Professional SP3 (EN)
Summary

Zend Optimizer is a free application that runs the files encoded using Zend Guard and enhances the overall performance of your PHP applications.

Description

The Zend Optimizer package for Windows is vulnerable to an elevation of privileges vulnerability which can be used by a simple user that can change the library file with a binary of choice. The vulnerability exist due to the improper permissions, with the 'F' flag (full control) for the 'Everyone' group, for the 'ZendExtensionManager.dll' library file and 'ZendOptimizer.dll' which are bundled with the Zend Optimizer (Runtime for PHP 5.2 and earlier) installation package.

Proof of Concept
zendoptimizer_iperms.txtTXT
Disclosure Timeline
01.02.2012Vulnerability discovered.
23.02.2012Contact with the vendor.
23.02.2012Vendor responds asking for details.
24.02.2012Sent detailed information to the vendor.
24.02.2012Vendor assigns appropriate team for coordination.
27.02.2012Vendor is analyzing the issue, working on a fix.
27.02.2012Asked vendor for confirmation and scheduled patch release date.
28.02.2012Vendor replies with confirmation of the issue.
05.03.2012Asked vendor for status update.
06.03.2012Vendor created fix for the issue, promising patch release date.
07.03.2012Sent coordination details to the vendor.
14.03.2012Asked vendor for status update.
14.03.2012Vendor replies.
21.03.2012Sent advisory release information to the vendor.
21.03.2012Vendor extends the patch release date.
29.03.2012Vendor publishes new version to address this issue.
03.04.2012Coordinated public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
[1]http://static.zend.com/topics/Zend-Optimizer-3.3.3-Release-Notes-V2.txt
[2]http://www.zend.com/en/products/guard/downloads
[3]http://www.securityfocus.com/bid/52866
[4]http://packetstormsecurity.org/files/111530
[5]http://cxsecurity.com/issue/WLB-2012040044
[6]http://secunia.com/advisories/48642/
[7]http://www.osvdb.org/show/osvdb/80935
[8]http://xforce.iss.net/xforce/xfdb/74580
Changelog
03.04.2012Initial release
04.04.2012Added reference [4] and [5]
06.04.2012Added reference [6] and [7]
20.04.2012Added reference [8]