LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: September 26th, 2014
Linux Security Week: September 22nd, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Debian: zope several vulnerabilities Print E-mail
User Rating:      How can I rate this item?
Posted by LinuxSecurity.com Team   
Debian This is an addition to DSA 043-1 which fixes several vulnerabilitiesin Zope. Something went wrong so it has to be corrected. Theprevious security release 2.1.6-7 has two severe problems.

----------------------------------------------------------------------------
Debian Security Advisory DSA-043-2                       security@debian.org 
http://www.debian.org/security/                               Martin Schulze
April 26, 2001
----------------------------------------------------------------------------

Packages       : zope
Vulnerability  : several
Type           : remote
Debian-specific: no
Fixed version  : zope 2.1.6-9

This is an addition to DSA 043-1 which fixes several vulnerabilities
in Zope.  Something went wrong so it has to be corrected.  The
previous security release 2.1.6-7 has two severe problems:

 1. zope 2.1.6-7 erronously included Hotfix 2000-10-02 (a fix for a
    vulnerability, which does only affect Zope 2.2.0 and later).  The
    inclusion of this Hotfix completely broke the authentification,
    which rendered zope 2.1.6-7 practically unusable.

    The Hotfix 2000-10-02 is removed in 2.1.6-9.

 2. The Hotfix 2000-10-11 in zope 2.1.6-7 was non-functional, leaving
    the package vulnerable to the possible exploit fixed by this
    Hotfix:

    Hotfix 2000-10-11 "ObjectManager subscripting"

    The issue involves the fact that the 'subscript notation' that can
    be used to access items of ObjectManagers (Folders) did not
    correctly restrict return values to only actual sub items.  This
    made it possible to access names that should be private from DTML
    (objects with names beginning with the underscore '_' character).
    This could allow DTML authors to see private implementation data
    structures and in certain cases possibly call methods that they
    shouldn't have access to from DTML.

    Hotfix 2000-10-11 is fixed in 2.1.6-9 and fixes this
    vulnerability.

We recommend that you upgrade your zope package immediately.

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 2.2 alias potato
------------------------------------

  Potato was released for the alpha, arm, i386, m68k, powerpc and sparc
  architectures.


  Source archives:

     http://security.debian.org/dists/stable/updates/main/source/zope_2.1.6-9.dsc
      MD5 checksum: c89f61955e3c676dc241fa7de64e4962
     http://security.debian.org/dists/stable/updates/main/source/zope_2.1.6-9.diff.gz
      MD5 checksum: 14199de307df2b8c786e7bf0de5c7a5f
     http://security.debian.org/dists/stable/updates/main/source/zope_2.1.6.orig.tar.gz
      MD5 checksum: 6ec4320afd6925c24f9f1b5cd7c4d7c5

  Alpha architecture:

     http://security.debian.org/dists/stable/updates/main/binary-alpha/zope_2.1.6-9_alpha.deb
      MD5 checksum: 4bc3e45fecb9ba97e9636c4f18a29db6

  ARM architecture:

     http://security.debian.org/dists/stable/updates/main/binary-arm/zope_2.1.6-9_arm.deb
      MD5 checksum: 8bdafc04fb0a24f41e297bfd1e6ee669

  Intel ia32 architecture:

     http://security.debian.org/dists/stable/updates/main/binary-i386/zope_2.1.6-9_i386.deb
      MD5 checksum: ae4f9c9addd2cc22e05ecf2c1da09a14

  Motorola 680x0 architecture:

     http://security.debian.org/dists/stable/updates/main/binary-m68k/zope_2.1.6-9_m68k.deb
      MD5 checksum: ea002a86ac1f57181b561ef41c2332c8

  PowerPC architecture:

     http://security.debian.org/dists/stable/updates/main/binary-powerpc/zope_2.1.6-9_powerpc.deb
      MD5 checksum: 315018ce263ff4f3c433a786bb738381

  Sun Sparc architecture:

     http://security.debian.org/dists/stable/updates/main/binary-sparc/zope_2.1.6-9_sparc.deb
      MD5 checksum: 9cdfe687f3058f556222b7fa55503dc3


  These files will be moved into
   ftp://ftp.debian.org/debian/dists/stable/*/binary-$arch/ soon.

For not yet released architectures please refer to the appropriate
directory  ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .

----------------------------------------------------------------------------
For apt-get: deb  http://security.debian.org/ stable/updates main
For dpkg-ftp:  ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and  http://packages.debian.org/



 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.