Symfony /_internal URI非法访问漏洞


发布日期:2012-12-27
更新日期:2012-12-30

受影响系统:
Symfony Symfony < 2.1.5
 Symfony Symfony < 2.0.20
描述:
--------------------------------------------------------------------------------
CVE(CAN) ID: CVE-2012-6432
 
Symfony 是一款基于MVC架构的PHP框架。它是一款免费软件,在MIT License许可下发行。
 
Symfony 2.0.x、2.1.x在启用了内部路由配置后,远程攻击者可通过/_internal字符串开头的URI访问原本受限的服务,从而可在受影响的服务器上执行被保护的控制包。
 
<*来源:vendor
 
  链接:http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6432
        http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released
 *>

建议:
--------------------------------------------------------------------------------
厂商补丁:
 
Symfony
 -------
 Symfony已经为此发布了一个安全公告(security-release-symfony-2-0-20-and-2-1-5-released)以及相应补丁:
 
security-release-symfony-2-0-20-and-2-1-5-released:Security release: Symfony 2.0.20 and 2.1.5 released
 
链接:http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released
 
补丁下载:https://github.com/symfony/symfony/commit/55014a6841bec50046e8329a4835c160ac31a496

相关内容