This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Zope First view 2009-08-07
Product Zodb Last view 2010-10-19
Version Type Application
Update  
Edition  
Language  
Sofware Edition  
Target Software  
Target Hardware  
Other  

Activity : Overall

COMMON PLATFORM ENUMERATION: Repartition per Version

CPE Name Affected CVE
cpe:2.3:a:zope:zodb:3.8.0:*:*:*:*:*:*:* 4
cpe:2.3:a:zope:zodb:3.8.1:*:*:*:*:*:*:* 4
cpe:2.3:a:zope:zodb:3.8:*:*:*:*:*:*:* 4
cpe:2.3:a:zope:zodb:3.7:*:*:*:*:*:*:* 3
cpe:2.3:a:zope:zodb:2.11.4:*:*:*:*:*:*:* 3
cpe:2.3:a:zope:zodb:2.8.11:*:*:*:*:*:*:* 3
cpe:2.3:a:zope:zodb:3.3:*:*:*:*:*:*:* 3
cpe:2.3:a:zope:zodb:3.4.1:*:*:*:*:*:*:* 3
cpe:2.3:a:zope:zodb:3.4:*:*:*:*:*:*:* 3
cpe:2.3:a:zope:zodb:2.10.9:*:*:*:*:*:*:* 3
cpe:2.3:a:zope:zodb:3.3.3:*:*:*:*:*:*:* 3
cpe:2.3:a:zope:zodb:3.2.4:*:*:*:*:*:*:* 3
cpe:2.3:a:zope:zodb:3.1:*:*:*:*:*:*:* 3
cpe:2.3:a:zope:zodb:3.6:*:*:*:*:*:*:* 3
cpe:2.3:a:zope:zodb:3.5:*:*:*:*:*:*:* 3
cpe:2.3:a:zope:zodb:3.1.1:*:*:*:*:*:*:* 3
cpe:2.3:a:zope:zodb:2.9.11:*:*:*:*:*:*:* 3
cpe:2.3:a:zope:zodb:3.2:*:*:*:*:*:*:* 3
cpe:2.3:a:zope:zodb:3.9.0:*:*:*:*:*:*:* 2
cpe:2.3:a:zope:zodb:3.9.0b5:*:*:*:*:*:*:* 2
cpe:2.3:a:zope:zodb:3.9.0b4:*:*:*:*:*:*:* 2
cpe:2.3:a:zope:zodb:3.9.0b3:*:*:*:*:*:*:* 2
cpe:2.3:a:zope:zodb:3.9.0b2:*:*:*:*:*:*:* 2
cpe:2.3:a:zope:zodb:3.9.0c1:*:*:*:*:*:*:* 2
cpe:2.3:a:zope:zodb:3.9.0b1:*:*:*:*:*:*:* 2
cpe:2.3:a:zope:zodb:3.8.2:*:*:*:*:*:*:* 2
cpe:2.3:a:zope:zodb:3.8.6:*:*:*:*:*:*:* 1

Related : CVE

  Date Alert Description
4.3 2010-10-19 CVE-2010-3495

Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.
6 2009-09-08 CVE-2009-2701

Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors.
7.5 2009-08-07 CVE-2009-0669

Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.
6.5 2009-08-07 CVE-2009-0668

Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.

CWE : Common Weakness Enumeration

%idName
33% (1) CWE-362 Race Condition
33% (1) CWE-287 Improper Authentication
33% (1) CWE-94 Failure to Control Generation of Code ('Code Injection')

Oval Markup Language : Definitions

OvalID Name
oval:org.mitre.oval:def:7440 DSA-1863 zope2.10/zope2.9 -- several vulnerabilities
oval:org.mitre.oval:def:13776 USN-848-1 -- zope3 vulnerabilities
oval:org.mitre.oval:def:13443 DSA-1863-1 zope2.10/zope2.9 -- several
oval:org.mitre.oval:def:12067 DSA-2234-1 zodb -- several

Open Source Vulnerability Database (OSVDB)

id Description
68608 Zope Object Database (ZODB) ZEO/StorageServer.py Multiple Client Connection R...
57760 Zope Object Database (ZODB) Zope Enterprise Objects (ZEO) Server Arbitrary Fi...
56827 Zope Object Database (ZODB) ZEO Storage Server Unspecified Arbitrary Python C...
56826 Zope Object Database (ZODB) ZEO Storage Server Unspecified Authentication Bypass

OpenVAS Exploits

id Description
2011-08-03 Name : Debian Security Advisory DSA 2234-1 (zodb)
File : nvt/deb_2234_1.nasl
2010-11-30 Name : Zope Object Database ZEO Server Denial of Service Vulnerability
File : nvt/gb_zodb_zeo_server_dos_vuln.nasl
2009-10-19 Name : Ubuntu USN-848-1 (zope3)
File : nvt/ubuntu_848_1.nasl
2009-09-02 Name : Debian Security Advisory DSA 1863-1 (zope2.10/zope2.9)
File : nvt/deb_1863_1.nasl

Nessus® Vulnerability Scanner

id Description
2011-05-11 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-2234.nasl - Type: ACT_GATHER_INFO
2010-02-24 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-1863.nasl - Type: ACT_GATHER_INFO
2009-10-15 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-848-1.nasl - Type: ACT_GATHER_INFO