6418360 2001-04-26 01:50 -0600 /132 rader/ <debian-security-announce@LISTS.DEBIAN.ORG>
Sänt av: joel@lysator.liu.se
Importerad: 2001-04-26 20:03 av Brevbäraren
Extern mottagare: BUGTRAQ@SECURITYFOCUS.COM
Externa svar till: security@debian.org
Mottagare: Bugtraq (import) <16803>
Ärende: [SECURITY] [DSA 043-2] New versions of Zope fix vulnerabilities
------------------------------------------------------------
From: debian-security-announce@LISTS.DEBIAN.ORG
To: BUGTRAQ@SECURITYFOCUS.COM
Message-ID: <sREB6C.A.YfH.5M956@murphy>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ----------------------------------------------------------------------------
Debian Security Advisory DSA-043-2 security@debian.org
http://www.debian.org/security/ Martin Schulze
April 26, 2001
- ----------------------------------------------------------------------------
Packages : zope
Vulnerability : several
Type : remote
Debian-specific: no
Fixed version : zope 2.1.6-9
This is an addition to DSA 043-1 which fixes several vulnerabilities
in Zope. Something went wrong so it has to be corrected. The
previous security release 2.1.6-7 has two severe problems:
1. zope 2.1.6-7 erronously included Hotfix 2000-10-02 (a fix for a
vulnerability, which does only affect Zope 2.2.0 and later). The
inclusion of this Hotfix completely broke the authentification,
which rendered zope 2.1.6-7 practically unusable.
The Hotfix 2000-10-02 is removed in 2.1.6-9.
2. The Hotfix 2000-10-11 in zope 2.1.6-7 was non-functional, leaving
the package vulnerable to the possible exploit fixed by this
Hotfix:
Hotfix 2000-10-11 "ObjectManager subscripting"
The issue involves the fact that the 'subscript notation' that can
be used to access items of ObjectManagers (Folders) did not
correctly restrict return values to only actual sub items. This
made it possible to access names that should be private from DTML
(objects with names beginning with the underscore '_' character).
This could allow DTML authors to see private implementation data
structures and in certain cases possibly call methods that they
shouldn't have access to from DTML.
Hotfix 2000-10-11 is fixed in 2.1.6-9 and fixes this
vulnerability.
We recommend that you upgrade your zope package immediately.
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 2.2 alias potato
- ------------------------------------
Potato was released for the alpha, arm, i386, m68k, powerpc and
sparc architectures.
Source archives:
http://security.debian.org/dists/stable/updates/main/source/zope_2.1.6-9.dsc
MD5 checksum: c89f61955e3c676dc241fa7de64e4962
http://security.debian.org/dists/stable/updates/main/source/zope_2.1.6-9.diff.gz
MD5 checksum: 14199de307df2b8c786e7bf0de5c7a5f
http://security.debian.org/dists/stable/updates/main/source/zope_2.1.6.orig.tar.gz
MD5 checksum: 6ec4320afd6925c24f9f1b5cd7c4d7c5
Alpha architecture:
http://security.debian.org/dists/stable/updates/main/binary-alpha/zope_2.1.6-9_alpha.deb
MD5 checksum: 4bc3e45fecb9ba97e9636c4f18a29db6
ARM architecture:
http://security.debian.org/dists/stable/updates/main/binary-arm/zope_2.1.6-9_arm.deb
MD5 checksum: 8bdafc04fb0a24f41e297bfd1e6ee669
Intel ia32 architecture:
http://security.debian.org/dists/stable/updates/main/binary-i386/zope_2.1.6-9_i386.deb
MD5 checksum: ae4f9c9addd2cc22e05ecf2c1da09a14
Motorola 680x0 architecture:
http://security.debian.org/dists/stable/updates/main/binary-m68k/zope_2.1.6-9_m68k.deb
MD5 checksum: ea002a86ac1f57181b561ef41c2332c8
PowerPC architecture:
http://security.debian.org/dists/stable/updates/main/binary-powerpc/zope_2.1.6-9_powerpc.deb
MD5 checksum: 315018ce263ff4f3c433a786bb738381
Sun Sparc architecture:
http://security.debian.org/dists/stable/updates/main/binary-sparc/zope_2.1.6-9_sparc.deb
MD5 checksum: 9cdfe687f3058f556222b7fa55503dc3
These files will be moved into
ftp://ftp.debian.org/debian/dists/stable/*/binary-$arch/ soon.
For not yet released architectures please refer to the appropriate
directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .
- ----------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE659LAW5ql+IAeqTIRAn4aAJ48fcGt+tOlxNDo65pSLu04OfzMFACffePt
iTLZxCzTYU9+MdjygEDfFlY=
=n9zf
-----END PGP SIGNATURE-----
-- To UNSUBSCRIBE, email to
debian-security-announce-request@lists.debian.org with a subject of
"unsubscribe". Trouble? Contact listmaster@lists.debian.org
(6418360) / <debian-security-announce@LISTS.DEBIAN.ORG>/(Ombruten)