Debian: zope several vulnerabilities

    Date26 Apr 2001
    CategoryDebian
    2614
    Posted ByLinuxSecurity Advisories
    This is an addition to DSA 043-1 which fixes several vulnerabilitiesin Zope. Something went wrong so it has to be corrected. Theprevious security release 2.1.6-7 has two severe problems.
    
    ----------------------------------------------------------------------------
    Debian Security Advisory DSA-043-2                       This email address is being protected from spambots. You need JavaScript enabled to view it. 
    http://www.debian.org/security/                               Martin Schulze
    April 26, 2001
    ----------------------------------------------------------------------------
    
    Packages       : zope
    Vulnerability  : several
    Type           : remote
    Debian-specific: no
    Fixed version  : zope 2.1.6-9
    
    This is an addition to DSA 043-1 which fixes several vulnerabilities
    in Zope.  Something went wrong so it has to be corrected.  The
    previous security release 2.1.6-7 has two severe problems:
    
     1. zope 2.1.6-7 erronously included Hotfix 2000-10-02 (a fix for a
        vulnerability, which does only affect Zope 2.2.0 and later).  The
        inclusion of this Hotfix completely broke the authentification,
        which rendered zope 2.1.6-7 practically unusable.
    
        The Hotfix 2000-10-02 is removed in 2.1.6-9.
    
     2. The Hotfix 2000-10-11 in zope 2.1.6-7 was non-functional, leaving
        the package vulnerable to the possible exploit fixed by this
        Hotfix:
    
        Hotfix 2000-10-11 "ObjectManager subscripting"
    
        The issue involves the fact that the 'subscript notation' that can
        be used to access items of ObjectManagers (Folders) did not
        correctly restrict return values to only actual sub items.  This
        made it possible to access names that should be private from DTML
        (objects with names beginning with the underscore '_' character).
        This could allow DTML authors to see private implementation data
        structures and in certain cases possibly call methods that they
        shouldn't have access to from DTML.
    
        Hotfix 2000-10-11 is fixed in 2.1.6-9 and fixes this
        vulnerability.
    
    We recommend that you upgrade your zope package immediately.
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 2.2 alias potato
    ------------------------------------
    
      Potato was released for the alpha, arm, i386, m68k, powerpc and sparc
      architectures.
    
    
      Source archives:
    
         http://security.debian.org/dists/stable/updates/main/source/zope_2.1.6-9.dsc
          MD5 checksum: c89f61955e3c676dc241fa7de64e4962
         http://security.debian.org/dists/stable/updates/main/source/zope_2.1.6-9.diff.gz
          MD5 checksum: 14199de307df2b8c786e7bf0de5c7a5f
         http://security.debian.org/dists/stable/updates/main/source/zope_2.1.6.orig.tar.gz
          MD5 checksum: 6ec4320afd6925c24f9f1b5cd7c4d7c5
    
      Alpha architecture:
    
         http://security.debian.org/dists/stable/updates/main/binary-alpha/zope_2.1.6-9_alpha.deb
          MD5 checksum: 4bc3e45fecb9ba97e9636c4f18a29db6
    
      ARM architecture:
    
         http://security.debian.org/dists/stable/updates/main/binary-arm/zope_2.1.6-9_arm.deb
          MD5 checksum: 8bdafc04fb0a24f41e297bfd1e6ee669
    
      Intel ia32 architecture:
    
         http://security.debian.org/dists/stable/updates/main/binary-i386/zope_2.1.6-9_i386.deb
          MD5 checksum: ae4f9c9addd2cc22e05ecf2c1da09a14
    
      Motorola 680x0 architecture:
    
         http://security.debian.org/dists/stable/updates/main/binary-m68k/zope_2.1.6-9_m68k.deb
          MD5 checksum: ea002a86ac1f57181b561ef41c2332c8
    
      PowerPC architecture:
    
         http://security.debian.org/dists/stable/updates/main/binary-powerpc/zope_2.1.6-9_powerpc.deb
          MD5 checksum: 315018ce263ff4f3c433a786bb738381
    
      Sun Sparc architecture:
    
         http://security.debian.org/dists/stable/updates/main/binary-sparc/zope_2.1.6-9_sparc.deb
          MD5 checksum: 9cdfe687f3058f556222b7fa55503dc3
    
    
      These files will be moved into
       ftp://ftp.debian.org/debian/dists/stable/*/binary-$arch/ soon.
    
    For not yet released architectures please refer to the appropriate
    directory  ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .
    
    ----------------------------------------------------------------------------
    For apt-get: deb  http://security.debian.org/ stable/updates main
    For dpkg-ftp:  ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and  http://packages.debian.org/
    
    
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"65","type":"x","order":"1","pct":57.52,"resources":[]},{"id":"88","title":"Should be more technical","votes":"15","type":"x","order":"2","pct":13.27,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"33","type":"x","order":"3","pct":29.2,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.