CVE:CVE-2009-4417
CNNVD:CNNVD-200912-350
Zend Framework (ZF)中的Zend_Log_Writer_Mail类的shutdown函数允许视情况而定的攻击者借助与"未公开事件"有关的向量对容器地址发送任意邮件信息。
solution:Upgrade zend framework to a higher version than 1.9.6,0.1.3:preview,0.1.4:preview,0.1.5:preview,0.2.0:preview,0.6.0:preview,0.7.0:preview,0.8.0:preview,0.9.0:beta,0.9.1:beta,0.9.2:beta,0.9.3:beta,1.0.0,1.0.0:rc1,1.0.0:rc2,1.0.0:rc3,1.0.1,1.0.2,1.0.3,1.0.4,1.5.0,1.5.0:preview,1.5.0:rc1,1.5.0:rc2,1.5.0:rc3,1.5.1,1.5.2,1.5.3,1.6.0,1.6.0:rc1,1.6.0:rc2,1.6.0:rc3,1.6.1,1.6.2,1.7.0,1.7.0:preview,1.7.1,1.7.2,1.7.3,1.7.4,1.7.5,1.7.6,1.7.7,1.7.8,1.8.0,1.8.0:alpha_1,1.8.0:beta_1,1.8.1,1.8.2,1.8.3,1.8.4,1.9,1.9.0,1.9.0:alpha_1,1.9.0:beta_1,1.9.0:rc1,1.9.1,1.9.2,1.9.3,1.9.4,1.9.5,and avoid the version (,1.9.6],0.1.3:preview,0.1.4:preview,0.1.5:preview,0.2.0:preview,0.6.0:preview,0.7.0:preview,0.8.0:preview,0.9.0:beta,0.9.1:beta,0.9.2:beta,0.9.3:beta,1.0.0,1.0.0:rc1,1.0.0:rc2,1.0.0:rc3,1.0.1,1.0.2,1.0.3,1.0.4,1.5.0,1.5.0:preview,1.5.0:rc1,1.5.0:rc2,1.5.0:rc3,1.5.1,1.5.2,1.5.3,1.6.0,1.6.0:rc1,1.6.0:rc2,1.6.0:rc3,1.6.1,1.6.2,1.7.0,1.7.0:preview,1.7.1,1.7.2,1.7.3,1.7.4,1.7.5,1.7.6,1.7.7,1.7.8,1.8.0,1.8.0:alpha_1,1.8.0:beta_1,1.8.1,1.8.2,1.8.3,1.8.4,1.9,1.9.0,1.9.0:alpha_1,1.9.0:beta_1,1.9.0:rc1,1.9.1,1.9.2,1.9.3,1.9.4,1.9.5