Executive Summary
| Summary | |
|---|---|
| Title | New versions of Zope fix vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | DSA-043 | First vendor Publication | 2001-03-09 |
| Vendor | Debian | Last vendor Modification | 2001-04-26 |
| Severity (Vendor) | N/A | Revision | 2 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 2.1 | Attack Range | Local |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| This is an addition to DSA 043-1 which fixes several vulnerabilities in Zope. Something went wrong so it has to be corrected. The previous security release 2.1.6-7 has two severe problems: 1. zope 2.1.6-7 erronously included Hotfix 2000-10-02 (a fix for a vulnerability, which does only affect Zope 2.2.0 and later). The inclusion of this Hotfix completely broke the authentification, which rendered zope 2.1.6-7 practically unusable. The Hotfix 2000-10-02 is removed in 2.1.6-9. 2. The Hotfix 2000-10-11 in zope 2.1.6-7 was non-functional, leaving the package vulnerable to the possible exploit fixed by this Hotfix: Hotfix 2000-10-11 "ObjectManager subscripting" The issue involves the fact that the 'subscript notation' that can be used to access items of ObjectManagers (Folders) did not correctly restrict return values to only actual sub items. This made it possible to access names that should be private from DTML (objects with names beginning with the underscore '_' character). This could allow DTML authors to see private implementation data structures and in certain cases possibly call methods that they shouldn't have access to from DTML. Hotfix 2000-10-11 is fixed in 2.1.6-9 and fixes this vulnerability. We recommend that you upgrade your zope package immediately. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 2.2 alias potato |
Original Source
| Url : http://www.debian.org/security/2001/dsa-043 |
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-01-17 | Name : Debian Security Advisory DSA 043-1 (zope) File : nvt/deb_043_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 6286 | Zope Class Return Value Modification Digital Creations Zope contains a flaw that may allow a malicious user to alter the method return values for affected classes. The issue is triggered because of a vulnerability in the handling of the method return values for the ObjectManager, PropertyManager, and PropertySheet classes. It is possible that the flaw may allow data manipulation in the classes resulting in a loss of integrity. |
| 6285 | Zope ZClass Modification Local DoS Zope contains a flaw that may allow a local denial of service. It is possible for a malicous user with through-the-web scripting capabilities to modify attributes or methods of existing ZClasses, which potentially interfere with normal site functionality, resulting in a loss of availability for the web server. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2012-09-06 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2001-025.nasl - Type : ACT_GATHER_INFO |
| 2012-09-06 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2001-049.nasl - Type : ACT_GATHER_INFO |
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-043.nasl - Type : ACT_GATHER_INFO |
| 2001-08-04 | Name : The remote web server contains an application server that is prone to a denia... File : zope_dos.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:25:23 |
|
