CVE-2014-8088

Name of the Vulnerable Software and Affected Versions Zend versions prior to 1.12.9 Zend 2.x versions prior to 2.2.8 Zend 2.3.x versions prior to 2.3.3

Description The issue allows remote attackers to bypass authentication through a password starting with a null byte, triggering an unauthenticated bind. This occurs due to a flaw in the Zend Ldap class and the ZendLdap component.

Recommendations For versions prior to 1.12.9, update to version 1.12.9 or later. For Zend 2.x versions prior to 2.2.8, update to version 2.2.8 or later. For Zend 2.3.x versions prior to 2.3.3, update to version 2.3.3 or later.