DSA-490-1 zope -- arbitrary code execution

Debian Security Advisory

DSA-490-1 zope -- arbitrary code execution

Date Reported:

17 Apr 2004

Affected Packages:

zope

Vulnerable:

Yes

Security database references:

In the Bugtraq database (at SecurityFocus): BugTraq ID 5812.
In Mitre's CVE dictionary: CVE-2002-0688.

More information:

A vulnerability has been discovered in the index support of the ZCatalog plug-in in Zope, an open source web application server. A flaw in the security settings of ZCatalog allows anonymous users to call arbitrary methods of catalog indexes. The vulnerability also allows untrusted code to do the same.

For the stable distribution (woody) this problem has been fixed in version 2.5.1-1woody1.

For the unstable distribution (sid) this problem has been fixed in version 2.6.0-0.1 and higher.

We recommend that you upgrade your zope package.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Source:

http://security.debian.org/pool/updates/main/z/zope/zope_2.5.1-1woody1.dsc

http://security.debian.org/pool/updates/main/z/zope/zope_2.5.1-1woody1.diff.gz

http://security.debian.org/pool/updates/main/z/zope/zope_2.5.1.orig.tar.gz

Alpha:

http://security.debian.org/pool/updates/main/z/zope/zope_2.5.1-1woody1_alpha.deb

ARM:

http://security.debian.org/pool/updates/main/z/zope/zope_2.5.1-1woody1_arm.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/z/zope/zope_2.5.1-1woody1_i386.deb

Intel IA-64:

http://security.debian.org/pool/updates/main/z/zope/zope_2.5.1-1woody1_ia64.deb

HPPA:

http://security.debian.org/pool/updates/main/z/zope/zope_2.5.1-1woody1_hppa.deb

Motorola 680x0:

http://security.debian.org/pool/updates/main/z/zope/zope_2.5.1-1woody1_m68k.deb

Big endian MIPS:

http://security.debian.org/pool/updates/main/z/zope/zope_2.5.1-1woody1_mips.deb

Little endian MIPS:

http://security.debian.org/pool/updates/main/z/zope/zope_2.5.1-1woody1_mipsel.deb

PowerPC:

http://security.debian.org/pool/updates/main/z/zope/zope_2.5.1-1woody1_powerpc.deb

IBM S/390:

http://security.debian.org/pool/updates/main/z/zope/zope_2.5.1-1woody1_s390.deb

Sun Sparc:

http://security.debian.org/pool/updates/main/z/zope/zope_2.5.1-1woody1_sparc.deb

MD5 checksums of the listed files are available in the original advisory.