Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2001.186 -- Debian Security Advisory DSA-043-2 New versions of Zope fix vulnerabilities 4 May 2001 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Zope Vendor: Debian Operating System: Debian GNU/Linux 2.2 (potato) Linux Unix Platform: Alpha ARM i386 Motorola PowerPC Sparc Impact: Increased Privileges Denial of Service Access Required: Remote - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - ---------------------------------------------------------------------------- Debian Security Advisory DSA-043-2 security@debian.org http://www.debian.org/security/ Martin Schulze April 26, 2001 - - ---------------------------------------------------------------------------- Packages : zope Vulnerability : several Type : remote Debian-specific: no Fixed version : zope 2.1.6-9 This is an addition to DSA 043-1 which fixes several vulnerabilities in Zope. Something went wrong so it has to be corrected. The previous security release 2.1.6-7 has two severe problems: 1. zope 2.1.6-7 erronously included Hotfix 2000-10-02 (a fix for a vulnerability, which does only affect Zope 2.2.0 and later). The inclusion of this Hotfix completely broke the authentification, which rendered zope 2.1.6-7 practically unusable. The Hotfix 2000-10-02 is removed in 2.1.6-9. 2. The Hotfix 2000-10-11 in zope 2.1.6-7 was non-functional, leaving the package vulnerable to the possible exploit fixed by this Hotfix: Hotfix 2000-10-11 "ObjectManager subscripting" The issue involves the fact that the 'subscript notation' that can be used to access items of ObjectManagers (Folders) did not correctly restrict return values to only actual sub items. This made it possible to access names that should be private from DTML (objects with names beginning with the underscore '_' character). This could allow DTML authors to see private implementation data structures and in certain cases possibly call methods that they shouldn't have access to from DTML. Hotfix 2000-10-11 is fixed in 2.1.6-9 and fixes this vulnerability. We recommend that you upgrade your zope package immediately. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 2.2 alias potato - - ------------------------------------ Potato was released for the alpha, arm, i386, m68k, powerpc and sparc architectures. Source archives: http://security.debian.org/dists/stable/updates/main/source/zope_2.1.6-9.dsc MD5 checksum: c89f61955e3c676dc241fa7de64e4962 http://security.debian.org/dists/stable/updates/main/source/zope_2.1.6-9.diff.gz MD5 checksum: 14199de307df2b8c786e7bf0de5c7a5f http://security.debian.org/dists/stable/updates/main/source/zope_2.1.6.orig.tar.gz MD5 checksum: 6ec4320afd6925c24f9f1b5cd7c4d7c5 Alpha architecture: http://security.debian.org/dists/stable/updates/main/binary-alpha/zope_2.1.6-9_alpha.deb MD5 checksum: 4bc3e45fecb9ba97e9636c4f18a29db6 ARM architecture: http://security.debian.org/dists/stable/updates/main/binary-arm/zope_2.1.6-9_arm.deb MD5 checksum: 8bdafc04fb0a24f41e297bfd1e6ee669 Intel ia32 architecture: http://security.debian.org/dists/stable/updates/main/binary-i386/zope_2.1.6-9_i386.deb MD5 checksum: ae4f9c9addd2cc22e05ecf2c1da09a14 Motorola 680x0 architecture: http://security.debian.org/dists/stable/updates/main/binary-m68k/zope_2.1.6-9_m68k.deb MD5 checksum: ea002a86ac1f57181b561ef41c2332c8 PowerPC architecture: http://security.debian.org/dists/stable/updates/main/binary-powerpc/zope_2.1.6-9_powerpc.deb MD5 checksum: 315018ce263ff4f3c433a786bb738381 Sun Sparc architecture: http://security.debian.org/dists/stable/updates/main/binary-sparc/zope_2.1.6-9_sparc.deb MD5 checksum: 9cdfe687f3058f556222b7fa55503dc3 These files will be moved into ftp://ftp.debian.org/debian/dists/stable/*/binary-$arch/ soon. For not yet released architectures please refer to the appropriate directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ . - - ---------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE659LAW5ql+IAeqTIRAn4aAJ48fcGt+tOlxNDo65pSLu04OfzMFACffePt iTLZxCzTYU9+MdjygEDfFlY= =n9zf - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to use any or all of this information is the responsibility of each user or organisation, and should be done so in accordance with site policies and procedures. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the original authors to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/Information/advisories.html If you believe that your system has been compromised, contact AusCERT or your representative in FIRST (Forum of Incident Response and Security Teams). Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for emergencies. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key iQCVAwUBOvKqoih9+71yA2DNAQGm3gP/aSz71ptoQUB+opnT8jx8qVbt8/b7R0As 2k4fwkXeWkR/GbNg7fiHIMI5LGoIu6RJ42lwSk0lIdtJirz/IMHg3J8UWob6zLMp GeVXtzZpvV96gic8JGaXpGwYL+8fHmYRO/2mll62IK7XY9w0TpQQSxninLCRRF4V 20BGwds6e4Y= =LFV3 -----END PGP SIGNATURE-----