Insufficient protection for Zope Image and File objects
21 Dec. 2000
Summary
Zope is the leading Open Source web application server. Zope enables teams to collaborate in the creation and management of dynamic web-based business applications such as intranets and portals. A new problem has been discovered in Zope, which gives users with DTML editing permission to update other objects that they should not be allowed to update.
Vulnerable systems:
Zope versions up to and including 2.2.4
A potential security issue exists in versions of Zope up to and including 2.2.4. This issue involves incorrect protection of a data updating method on Image and File objects. Because the method was not correctly protected, it was possible for users with DTML editing privileges to update the raw data of a File or Image object via DTML though they did not have editing privileges on the objects themselves.
Solution:
Upgrade your Zope package.
Debian
This has been fixed in version 2.1.6-5.4 by including the 2000-12-19 hot fix, and it is recommended that you upgrade your Zope package immediately.
wget url
will fetch the file for you dpkg -i file.deb
will install the referenced file.
Debian GNU/Linux 2.2 alias potato
Potato was released for alpha, arm, i386, m68k, PowerPC and Sparc.
Updated packages are available in the "updates/[ver]/RPMS/" directory.
For example, if you are looking for an updated RPM package for Linux-Mandrake 7.2, look for it in "updates/7.2/RPMS/". Updated source RPMs are available as well, but you generally do not need to download them.
