drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in Zope
Name: |
Ausführen beliebiger Kommandos in Zope |
|
ID: |
USN-229-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 5.10 |
|
Datum: |
Di, 13. Dezember 2005, 18:44 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3323 |
|
Applikationen: |
Zope |
|
Originalnachricht |
--===============1518434814== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="EuxKj2iCbKjpUGkD" Content-Disposition: inline
--EuxKj2iCbKjpUGkD Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
=========================================================== Ubuntu Security Notice USN-229-1 December 13, 2005 zope2.8 vulnerability CVE-2005-3323 ===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 5.10 (Breezy Badger)
The following packages are affected:
zope2.8 zope2.8-sandbox
The problem can be corrected by upgrading the affected package to version 2.8.1-5ubuntu0.1. In general, a standard system upgrade is sufficient to effect the necessary changes.
Details follow:
Zope did not deactivate the file inclusion feature when exposing RestructuredText functionalities to untrusted users. A remote user with the privilege of editing Zope webpages with RestructuredText could exploit this to expose arbitrary files that can be read with the privileges of the Zope server, or execute arbitrary Zope code.
Source archives:
zope2.8_2.8.1-5ubuntu0.1.diff.gz Size/MD5: 12721 12280d0cc8ba16dc3565199620486f59 zope2.8_2.8.1-5ubuntu0.1.dsc Size/MD5: 826 bef9b6d223a40195bc51d4d30b81f73d zope2.8_2.8.1.orig.tar.gz Size/MD5: 5343921 0ec441a35175bb8d8c557b7d3c63f6f6
Architecture independent packages:
zope2.8-sandbox_2.8.1-5ubuntu0.1_all.deb Size/MD5: 18484 956dae0711ab24cf2b58e69dc79856ce
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
zope2.8_2.8.1-5ubuntu0.1_amd64.deb Size/MD5: 5521388 162861be153d25a7fb0319502fd4046b
i386 architecture (x86 compatible Intel/AMD)
zope2.8_2.8.1-5ubuntu0.1_i386.deb Size/MD5: 5463616 17e5eaf3029498f507de22f7ff97ba24
powerpc architecture (Apple Macintosh G3/G4/G5)
zope2.8_2.8.1-5ubuntu0.1_powerpc.deb Size/MD5: 5551644 e8ee35fca963b06fa6bab479785155ee
--EuxKj2iCbKjpUGkD Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux)
iD8DBQFDnwM3DecnbV4Fd/IRAgarAJ9j8t+4EDCxNZ2SK+woybxbqnceHwCgqtL7 k+GfKGKf0fXkbgQMMkLOmIA= =Gu/h -----END PGP SIGNATURE-----
--EuxKj2iCbKjpUGkD--
--===============1518434814== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com http://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============1518434814==--
|
|
|
|