Description
Zend Platform 2.2.3 and earlier has incorrect ownership for scd.sh and certain other files, which allows local users to gain root privileges by modifying the files. NOTE: this only occurs when safe_mode and open_basedir are disabled; other settings require leverage for other vulnerabilities.
References
- http://www.php-security.org/MOPB/BONUS-06-2007.html
- ADV-2007-0829 vdb-entry
- 32772 vdb-entry
- 22801 vdb-entry
- 24501 third-party-advisory
- zend-scd-privilege-escalation(32825) vdb-entry
- http://www.zend.com/products/zend_platform/security_vulnerabilities