AusCERT - ESB-2000.395 -- RHSA-2000:125-02 -- New Zope packages are available

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
ESB-2000.395 -- RHSA-2000:125-02 -- New Zope packages are available
Date: 14 December 2000
References: ESB-2001.015 ESB-2001.209

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
              AUSCERT External Security Bulletin Redistribution
                             
                      ESB-2000.395 -- RHSA-2000:125-02
                       New Zope packages are available
                              14 December 2000

===========================================================================

	AusCERT Security Bulletin Summary
	---------------------------------

Product:                Zope
Vendor:                 Red Hat
Operating System:       Red Hat Linux
Impact:                 Increased Privileges
Access Required:        Remote

- --------------------------BEGIN INCLUDED TEXT--------------------

- ---------------------------------------------------------------------
                   Red Hat, Inc. Security Advisory

Synopsis:          New Zope packages are available.
Advisory ID:       RHSA-2000:125-02
Issue date:        2000-12-12
Updated on:        2000-12-12
Product:           Red Hat Powertools
Keywords:          N/A
Cross references:  N/A
- ---------------------------------------------------------------------

1. Topic:

Vulnerability in legacy names allows calling those contructors without the
correct permissions.

2. Relevant releases/architectures:

Red Hat Powertools 6.1 - i386, alpha, sparc
Red Hat Powertools 6.2 - i386, alpha, sparc
Red Hat Powertools 7.0 - i386, alpha

3. Problem description:

A vulnerablity exists in previously released versions of Zope where users
can create new DTML method instances through the Web without having the
correct permissions.

4. Solution:

For each RPM for your particular architecture, run:

rpm -Fvh [filename]

where filename is the name of the RPM.

Make sure that you have applied all updates for Apache if you are using the
Zope-pcgi package.

NOTE: This errata supercedes all other advisories from Red Hat concerning
Zope.

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):

N/A

6. RPMs required:

Red Hat Powertools 6.2:

alpha:
ftp://updates.redhat.com/powertools/6.2/alpha/Zope-2.2.4-3.alpha.rpm
ftp://updates.redhat.com/powertools/6.2/alpha/Zope-components-2.2.4-3.alpha.rpm
ftp://updates.redhat.com/powertools/6.2/alpha/Zope-core-2.2.4-3.alpha.rpm
ftp://updates.redhat.com/powertools/6.2/alpha/Zope-pcgi-2.2.4-3.alpha.rpm
ftp://updates.redhat.com/powertools/6.2/alpha/Zope-services-2.2.4-3.alpha.rpm
ftp://updates.redhat.com/powertools/6.2/alpha/Zope-zpublisher-2.2.4-3.alpha.rpm
ftp://updates.redhat.com/powertools/6.2/alpha/Zope-zserver-2.2.4-3.alpha.rpm
ftp://updates.redhat.com/powertools/6.2/alpha/Zope-ztemplates-2.2.4-3.alpha.rpm

sparc:
ftp://updates.redhat.com/powertools/6.2/sparc/Zope-2.2.4-3.sparc.rpm
ftp://updates.redhat.com/powertools/6.2/sparc/Zope-components-2.2.4-3.sparc.rpm
ftp://updates.redhat.com/powertools/6.2/sparc/Zope-core-2.2.4-3.sparc.rpm
ftp://updates.redhat.com/powertools/6.2/sparc/Zope-pcgi-2.2.4-3.sparc.rpm
ftp://updates.redhat.com/powertools/6.2/sparc/Zope-services-2.2.4-3.sparc.rpm
ftp://updates.redhat.com/powertools/6.2/sparc/Zope-zpublisher-2.2.4-3.sparc.rpm
ftp://updates.redhat.com/powertools/6.2/sparc/Zope-zserver-2.2.4-3.sparc.rpm
ftp://updates.redhat.com/powertools/6.2/sparc/Zope-ztemplates-2.2.4-3.sparc.rpm

i386:
ftp://updates.redhat.com/powertools/6.2/i386/Zope-2.2.4-3.i386.rpm
ftp://updates.redhat.com/powertools/6.2/i386/Zope-components-2.2.4-3.i386.rpm
ftp://updates.redhat.com/powertools/6.2/i386/Zope-core-2.2.4-3.i386.rpm
ftp://updates.redhat.com/powertools/6.2/i386/Zope-pcgi-2.2.4-3.i386.rpm
ftp://updates.redhat.com/powertools/6.2/i386/Zope-services-2.2.4-3.i386.rpm
ftp://updates.redhat.com/powertools/6.2/i386/Zope-zpublisher-2.2.4-3.i386.rpm
ftp://updates.redhat.com/powertools/6.2/i386/Zope-zserver-2.2.4-3.i386.rpm
ftp://updates.redhat.com/powertools/6.2/i386/Zope-ztemplates-2.2.4-3.i386.rpm

sources:
ftp://updates.redhat.com/powertools/6.2/SRPMS/Zope-2.2.4-3.src.rpm

Red Hat Powertools 7.0:

alpha:
ftp://updates.redhat.com/powertools/7.0/alpha/Zope-2.2.4-4.alpha.rpm
ftp://updates.redhat.com/powertools/7.0/alpha/Zope-components-2.2.4-4.alpha.rpm
ftp://updates.redhat.com/powertools/7.0/alpha/Zope-core-2.2.4-4.alpha.rpm
ftp://updates.redhat.com/powertools/7.0/alpha/Zope-pcgi-2.2.4-4.alpha.rpm
ftp://updates.redhat.com/powertools/7.0/alpha/Zope-services-2.2.4-4.alpha.rpm
ftp://updates.redhat.com/powertools/7.0/alpha/Zope-zpublisher-2.2.4-4.alpha.rpm
ftp://updates.redhat.com/powertools/7.0/alpha/Zope-zserver-2.2.4-4.alpha.rpm
ftp://updates.redhat.com/powertools/7.0/alpha/Zope-ztemplates-2.2.4-4.alpha.rpm

i386:
ftp://updates.redhat.com/powertools/7.0/i386/Zope-2.2.4-4.i386.rpm
ftp://updates.redhat.com/powertools/7.0/i386/Zope-components-2.2.4-4.i386.rpm
ftp://updates.redhat.com/powertools/7.0/i386/Zope-core-2.2.4-4.i386.rpm
ftp://updates.redhat.com/powertools/7.0/i386/Zope-pcgi-2.2.4-4.i386.rpm
ftp://updates.redhat.com/powertools/7.0/i386/Zope-services-2.2.4-4.i386.rpm
ftp://updates.redhat.com/powertools/7.0/i386/Zope-zpublisher-2.2.4-4.i386.rpm
ftp://updates.redhat.com/powertools/7.0/i386/Zope-zserver-2.2.4-4.i386.rpm
ftp://updates.redhat.com/powertools/7.0/i386/Zope-ztemplates-2.2.4-4.i386.rpm

sources:
ftp://updates.redhat.com/powertools/7.0/SRPMS/Zope-2.2.4-4.src.rpm

7. Verification:

MD5 sum                           Package Name
- --------------------------------------------------------------------------
7f23985cf46d3dd1549c3efb61008064  6.2/SRPMS/Zope-2.2.4-3.src.rpm
d7f73eea703056eb44007e7044c1ee01  6.2/alpha/Zope-2.2.4-3.alpha.rpm
73c19b7937255380af1877ff9ccfa7ab  6.2/alpha/Zope-components-2.2.4-3.alpha.rpm
8fa91974cbf97bd63e9d93d9f428f4ef  6.2/alpha/Zope-core-2.2.4-3.alpha.rpm
4ba68e9f304084bc05ba8b81073afe4b  6.2/alpha/Zope-pcgi-2.2.4-3.alpha.rpm
46c6e6d2347cae0b1d72292af7bb8868  6.2/alpha/Zope-services-2.2.4-3.alpha.rpm
68b4230f02400568ad4ddecf27317bd4  6.2/alpha/Zope-zpublisher-2.2.4-3.alpha.rpm
dd2fec391397a727106aa9ea3da45a7e  6.2/alpha/Zope-zserver-2.2.4-3.alpha.rpm
377f033d43839e30d687f92389b01af9  6.2/alpha/Zope-ztemplates-2.2.4-3.alpha.rpm
3bde2f09e75432dba375863c7740b9dc  6.2/i386/Zope-2.2.4-3.i386.rpm
dfc304409d9c7397a316de5849fa0d48  6.2/i386/Zope-components-2.2.4-3.i386.rpm
c3e561101a3c49a024b600aaac5263e0  6.2/i386/Zope-core-2.2.4-3.i386.rpm
7e9f96be58da0dbf2525f2e63e35f497  6.2/i386/Zope-pcgi-2.2.4-3.i386.rpm
f969f0c7ff3d293217c9ce90bee1abed  6.2/i386/Zope-services-2.2.4-3.i386.rpm
1593e474602258fc1ef21ac79f6e639b  6.2/i386/Zope-zpublisher-2.2.4-3.i386.rpm
abf5a7c5938bdc27d3887137871b724c  6.2/i386/Zope-zserver-2.2.4-3.i386.rpm
6e347722a0827f60dcf97b118d3f3e60  6.2/i386/Zope-ztemplates-2.2.4-3.i386.rpm
a7f02426dc7390e816ac1738b1fe5c4c  6.2/sparc/Zope-2.2.4-3.sparc.rpm
799085909efa49091c938451e64a3eac  6.2/sparc/Zope-components-2.2.4-3.sparc.rpm
5692eb110c4a82a5cd605d9108112981  6.2/sparc/Zope-core-2.2.4-3.sparc.rpm
93a9fdb0a3425cb64bbdc59cb323c53e  6.2/sparc/Zope-pcgi-2.2.4-3.sparc.rpm
0f1207038f08bfc3640a3a9a57077a7c  6.2/sparc/Zope-services-2.2.4-3.sparc.rpm
cd96eee2c2465858c9762e945edd4831  6.2/sparc/Zope-zpublisher-2.2.4-3.sparc.rpm
0d8c06bfce677efe6ebd792f4909e933  6.2/sparc/Zope-zserver-2.2.4-3.sparc.rpm
1b9942b112082d9d2ac4a45d49fc20e1  6.2/sparc/Zope-ztemplates-2.2.4-3.sparc.rpm
aa6dc280ac9cd160a59cc94a422f33d7  7.0/SRPMS/Zope-2.2.4-4.src.rpm
6ba5ab5536c6febe1baa5115545501ba  7.0/alpha/Zope-2.2.4-4.alpha.rpm
303db0df979bb5108d6b0ec1dc9b7086  7.0/alpha/Zope-components-2.2.4-4.alpha.rpm
651553ed0a862019ed6ae1b7f61b95d6  7.0/alpha/Zope-core-2.2.4-4.alpha.rpm
babed78c7c795052e26877862205e1a6  7.0/alpha/Zope-pcgi-2.2.4-4.alpha.rpm
18c9a4075c7bb4a5d04dfab1b7180046  7.0/alpha/Zope-services-2.2.4-4.alpha.rpm
485304852c9ca212b7b64724ba1568d3  7.0/alpha/Zope-zpublisher-2.2.4-4.alpha.rpm
4571271fd46f3e888f033604a30aa0dd  7.0/alpha/Zope-zserver-2.2.4-4.alpha.rpm
fbd063e9b50a164ecad4672e9b1244e6  7.0/alpha/Zope-ztemplates-2.2.4-4.alpha.rpm
f53ebebbb586cd0a7a273249d8d31d46  7.0/i386/Zope-2.2.4-4.i386.rpm
6d732f25729bdb4cdd7f6e31c7166622  7.0/i386/Zope-components-2.2.4-4.i386.rpm
7ab10f25d8db9e146161a89e1e8dfd93  7.0/i386/Zope-core-2.2.4-4.i386.rpm
c144ac2c1b10b0c260ac0224018c99b8  7.0/i386/Zope-pcgi-2.2.4-4.i386.rpm
d4b6a2064f721dec5ca83dc3336ccbde  7.0/i386/Zope-services-2.2.4-4.i386.rpm
8f6b0b0baa3c3da30f5eb43d14ed9ab5  7.0/i386/Zope-zpublisher-2.2.4-4.i386.rpm
5b3e3e6f31cc56a797464602fd7057f5  7.0/i386/Zope-zserver-2.2.4-4.i386.rpm
e9ecf895e293c0e05cb502c3042fdb21  7.0/i386/Zope-ztemplates-2.2.4-4.i386.rpm

These packages are GPG signed by Red Hat, Inc. for security.  Our key
is available at:
    http://www.redhat.com/corp/contact.html

You can verify each package with the following command:
    rpm --checksig  <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    rpm --checksig --nogpg <filename>

8. References:

http://www.zope.org/Products/Zope/Hotfix_2000-12-08/security_alert


Copyright(c) 2000 Red Hat, Inc.

- --------------------------END INCLUDED TEXT--------------------

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBOlSNbih9+71yA2DNAQFnaQQAl4JznQk9aHBUY9EnH1Ix5Su8d9GtNccT
UGZBqY8YTDho2YJtMBxh5ZQ3urJheU9W2yc3EVs2GX9b2m7Zs1XUcjLc7U5I5BH8
hIUQnP9hA3SxdTxbxkiWxD0PjRviGD2BS9Jrp39BPJaz8X4f817e/1MCev04YPG4
lkJKtmaEfZ0=
=XJmO
-----END PGP SIGNATURE-----