Zope Object Database ZEO Server Remote Security Bypass Vulnerability

Bugtraq ID:	36283
Class:	Input Validation Error
CVE:	CVE-2009-2701
Remote:	Yes
Local:	No
Published:	Sep 01 2009 12:00AM
Updated:	Sep 21 2009 03:40PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Zope Zope 3.4.1 Zope Zope 2.11.4 Zope Zope 2.10.9 Python Software Foundation Zope Object Database (ZODB) 3.8.2 Python Software Foundation Zope Object Database (ZODB) 3.8 Pardus Linux 2009 0
Not Vulnerable:	Python Software Foundation Zope Object Database (ZODB) 3.8.3

Zope Object Database ZEO Server Remote Security Bypass Vulnerability

Zope Object Database ZEO Server is prone to a security-bypass vulnerability that attackers can leverage to execute certain actions in the context of the application.

Attackers can leverage this issue to read or delete arbitrary files. Other attacks may also be possible.

This vulnerability was introduced in Zope Object Database 3.8 and fixed in 3.8.3.

Zope Object Database ZEO Server Remote Security Bypass Vulnerability

Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Zope Object Database ZEO Server Remote Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Zope Object Database ZEO Server Remote Security Bypass Vulnerability

References:

• [Zope-Annce] CVE-2009-2701: Releases to fix ZODB ZEO server vulnerability (Jim Fulton)
  
• ZODB Homepage (Python Software Foundation)
  
• Zope Homepage (Zope)