bugtraq - [USN-229-1] Zope vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20051213172159.GB30925@piware.de>
Date: Tue, 13 Dec 2005 18:21:59 +0100
From: Martin Pitt <martin.pitt@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-229-1] Zope vulnerability

===========================================================
Ubuntu Security Notice USN-229-1	  December 13, 2005
zope2.8 vulnerability
CVE-2005-3323
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 5.10 (Breezy Badger)

The following packages are affected:

zope2.8
zope2.8-sandbox

The problem can be corrected by upgrading the affected package to
version 2.8.1-5ubuntu0.1.  In general, a standard system upgrade is
sufficient to effect the necessary changes.

Details follow:

Zope did not deactivate the file inclusion feature when exposing
RestructuredText functionalities to untrusted users. A remote user
with the privilege of editing Zope webpages with RestructuredText
could exploit this to expose arbitrary files that can be read with the
privileges of the Zope server, or execute arbitrary Zope code.


  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/z/zope2.8/zope2.8_2.8.1-5ubuntu0.1.diff.gz
      Size/MD5:    12721 12280d0cc8ba16dc3565199620486f59
    http://security.ubuntu.com/ubuntu/pool/main/z/zope2.8/zope2.8_2.8.1-5ubuntu0.1.dsc
      Size/MD5:      826 bef9b6d223a40195bc51d4d30b81f73d
    http://security.ubuntu.com/ubuntu/pool/main/z/zope2.8/zope2.8_2.8.1.orig.tar.gz
      Size/MD5:  5343921 0ec441a35175bb8d8c557b7d3c63f6f6

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/z/zope2.8/zope2.8-sandbox_2.8.1-5ubuntu0.1_all.deb
      Size/MD5:    18484 956dae0711ab24cf2b58e69dc79856ce

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/z/zope2.8/zope2.8_2.8.1-5ubuntu0.1_amd64.deb
      Size/MD5:  5521388 162861be153d25a7fb0319502fd4046b

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/z/zope2.8/zope2.8_2.8.1-5ubuntu0.1_i386.deb
      Size/MD5:  5463616 17e5eaf3029498f507de22f7ff97ba24

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/z/zope2.8/zope2.8_2.8.1-5ubuntu0.1_powerpc.deb
      Size/MD5:  5551644 e8ee35fca963b06fa6bab479785155ee

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/