-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                ESB-2006.0475 -- [Win][UNIX/Linux][Debian]
        New Zope version fixes information disclosure vulnerability
                               19 July 2006

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              zope 2.7
Publisher:            Debian
Operating System:     Debian GNU/Linux 3.1
                      UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact:               Read-only Data Access
Access:               Existing Account
CVE Names:            CVE-2006-3458

Original Bulletin:    http://www.debian.org/security/2006/dsa-1113

Comment: This advisory references vulnerabilities in products which run on
         platforms other than Debian. It is recommended that administrators
         using Zope check for an updated version of the software for their
         operating system at http://www.zope.org.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - --------------------------------------------------------------------------
Debian Security Advisory DSA 1113-1                    security@debian.org
http://www.debian.org/security/                         Moritz Muehlenhoff
July 18th, 2006                         http://www.debian.org/security/faq
- - --------------------------------------------------------------------------

Package        : zope2.7
Vulnerability  : programming error
Problem-Type   : remote
Debian-specific: no
CVE ID         : CVE-2006-3458
Debian Bug     : 377277

It was discovered that the Zope web application server allows read access
to arbitrary pages on the server, if a user has the privilege to edit
"restructured text" pages.

For the stable distribution (sarge) this problem has been fixed in
version 2.7.5-2sarge2.

The unstable distribution (sid) does no longer contain Zope 2.7 packages.

We recommend that you upgrade your zope2.7 package.


Upgrade Instructions
- - --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.1 alias sarge
- - --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge2.dsc
      Size/MD5 checksum:      906 e23c6dc88c7af48940e86fa41f97d536
    http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge2.diff.gz
      Size/MD5 checksum:    51266 a30c65b102a2ae75eb8e953826ec397b
    http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5.orig.tar.gz
      Size/MD5 checksum:  2885871 5b5c5823c62370d9f7325c6014a49d8b

  Alpha architecture:

    http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge2_alpha.deb
      Size/MD5 checksum:  2669594 3012b1b7c60fbaa2a4e28270d8524993

  AMD64 architecture:

    http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge2_amd64.deb
      Size/MD5 checksum:  2661200 a2396ea45bdee6684526e50bbd91d407

  ARM architecture:

    http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge2_arm.deb
      Size/MD5 checksum:  2615998 94eba92b3e764b1409d9f204752c145d

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge2_i386.deb
      Size/MD5 checksum:  2608476 0d2255ee8404c285df5d218ff1720ca1

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge2_ia64.deb
      Size/MD5 checksum:  2959536 3f930a43af8b566f3ea791d7dd37b5cd

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge2_hppa.deb
      Size/MD5 checksum:  2736776 55734b807c8b20f65e6e0df0e2e27820

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge2_m68k.deb
      Size/MD5 checksum:  2601508 29c0606574cb83e54d8df984e0a45b25

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge2_mips.deb
      Size/MD5 checksum:  2675708 d48d0ef186ac908b5ab29c930e12dcb7

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge2_mipsel.deb
      Size/MD5 checksum:  2678350 2f8078005091cea22255944c8f5d0953

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge2_powerpc.deb
      Size/MD5 checksum:  2724040 ea43d949c6e6d8970d58088dc112bc78

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge2_s390.deb
      Size/MD5 checksum:  2663274 140d55d68fdcbe8397f3d0ec13087f7e

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge2_sparc.deb
      Size/MD5 checksum:  2670674 cbdb9f302896fd372cd583be41a8ec2a

  These files will probably be moved into the stable distribution on
  its next update.

- - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFEvVCnXm3vHE4uyloRAlQ2AJ9jb+33gTkXw9uR2dpWFbjY6vPU2QCfUNQ9
httpW0iB9j8ethB8nAad83w=
=P+hr
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRL1xBSh9+71yA2DNAQJFzAP+Nge4lv5tXggp0TK2iLiNoFKGBv84gJrz
hGsjG9j9nsSITMHtAvnb/8EFnTFHUqtr8XqegyhnsW3HGw6vOASv59vYcof0LxhX
oifdxbgwfOaH/BGMQ85wlQtN/eQQlIujKJihSipMqjIaxJa/YxUzpbAbYuUWhfZ5
t4aJe3dOs0s=
=p/wt
-----END PGP SIGNATURE-----