Plone Multiple Modules Script Execution Vulnerabilities

Bugtraq ID:	26354
Class:	Unknown
CVE:	CVE-2007-5741
Remote:	Yes
Local:	No
Published:	Nov 06 2007 12:00AM
Updated:	Jan 03 2008 02:10PM
Credit:	The vendor reported these issues.
Vulnerable:	Plone Plone 3.0.2 Plone Plone 3.0.1 Plone Plone 2.5.4 Plone Plone 2.5.1 Plone Plone 3.0 Plone Plone 2.5-beta1 Plone Plone 2.5 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:

Plone Multiple Modules Script Execution Vulnerabilities

Plone is affected by multiple script-execution vulnerabilities.

Exploiting these issues may allow remote attackers to execute arbitrary Python code in the context of the application. This may facilitate remote unauthorized access to an affected computer.

These versions are affected:

Plone 2.5.4 and prior versions of the 2.5 branch
Plone 3.0.2 and prior versions of the 3.0 branch

Plone Multiple Modules Script Execution Vulnerabilities

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Plone Multiple Modules Script Execution Vulnerabilities

Solution:
The vendor has released a hotfix to address these issues. Please see the referenced advisories for more information.


Plone Plone 2.5-beta1

• Plone PloneHotfix20071106.tar.gz
  http://plone.org/products/plone-hotfix/releases/20071106/PloneHotfix20 071106.tar.gz

Plone Plone 3.0

• Plone PloneHotfix20071106.tar.gz
  http://plone.org/products/plone-hotfix/releases/20071106/PloneHotfix20 071106.tar.gz

Plone Plone 2.5

• Plone PloneHotfix20071106.tar.gz
  http://plone.org/products/plone-hotfix/releases/20071106/PloneHotfix20 071106.tar.gz

Plone Plone 2.5.1

• Plone PloneHotfix20071106.tar.gz
  http://plone.org/products/plone-hotfix/releases/20071106/PloneHotfix20 071106.tar.gz

Plone Plone 2.5.4

• Plone PloneHotfix20071106.tar.gz
  http://plone.org/products/plone-hotfix/releases/20071106/PloneHotfix20 071106.tar.gz

Plone Plone 3.0.1

• Plone PloneHotfix20071106.tar.gz
  http://plone.org/products/plone-hotfix/releases/20071106/PloneHotfix20 071106.tar.gz

Plone Plone 3.0.2

• Plone PloneHotfix20071106.tar.gz
  http://plone.org/products/plone-hotfix/releases/20071106/PloneHotfix20 071106.tar.gz

Plone Multiple Modules Script Execution Vulnerabilities

References:

• Plone Homepage (Plone)
  
• Plone Hotfix 20071106 (Plone)
  
• [CVE-2007-5741] Plone: statusmessages and linkintegrity unsafe network data hotf ([email protected])