Zope 'cmd' Parameter Remote Command Execution Vulnerability

Bugtraq ID:	49857
Class:	Input Validation Error
CVE:	CVE-2011-3587
Remote:	Yes
Local:	No
Published:	Sep 29 2011 12:00AM
Updated:	Dec 21 2011 11:19PM
Credit:	Alan Hoey
Vulnerable:	Zope Zope 2.13.9 Zope Zope 2.13.8 Zope Zope 2.13 Zope Zope 2.12.19 Zope Zope 2.12 Plone Plone 4.0.8 Plone Plone 4.0.7 Plone Plone 4.2a2 Plone Plone 4.2a1 Plone Plone 4.2 Plone Plone 4.1 Plone Plone 4.0.9 Plone Plone 4.0.5 Plone Plone 4.0.4 Plone Plone 4.0.3 Plone Plone 4.0.2 Plone Plone 4.0.1 Plone Plone 4.0
Not Vulnerable:	Zope Zope 2.12.20 Zope Zope 2.13.10

Zope 'cmd' Parameter Remote Command Execution Vulnerability

Zope is prone to a remote command-execution vulnerability because it fails to properly validate user-supplied input.

An attacker can execute arbitrary commands with the privileges of the affected application.

Zope 'cmd' Parameter Remote Command Execution Vulnerability

The following exploit input is available:

• /data/vulnerabilities/exploits/49857.txt

Zope 'cmd' Parameter Remote Command Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.

Zope 'cmd' Parameter Remote Command Execution Vulnerability

References:

• Plone Homepage (Plone)
  
• Security vulnerability announcement: 20110928 - Arbitrary Code Execution (Plone)
  
• Zope Homepage (Zope)
  
• Security vulnerability announcement: CVE 2011-3587 (Zope)