Bug 513422 (CVE-2009-0668)

Summary:

CVE-2009-0668 zope: ZEO arbitrary Python code execution in the context of server process

Product:

[Other] Security Response

Reporter:

Jan Lieskovsky <jlieskov>

Component:

vulnerability

Assignee:

Red Hat Product Security <security-response-team>

Status:

CLOSED NEXTRELEASE

QA Contact:

Severity:

high

Docs Contact:

Priority:

high

Version:

unspecified

CC:

jonathansteffan, rmccabe

Target Milestone:

---

Keywords:

Security

Target Release:

---

Hardware:

All

OS:

Linux

Whiteboard:

Fixed In Version:

Doc Type:

Bug Fix

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2009-09-07 21:41:23 UTC

Type:

---

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Attachments:

Description	Flags
ZEO patch by Jim Fulton (for both CVE-2009-0668 and CVE-2009-0669)	none

Description Jan Lieskovsky 2009-07-23 15:22:34 UTC

A missing access control check was found in the way Zope Enterprise Objects (ZEO) used to manage remote connections to the Zope server. A remote attacker
could use this flaw to execute arbitrary Python code in the context of
Zope server.

Comment 1 Jan Lieskovsky 2009-07-23 15:24:45 UTC

Created attachment 354876 [details]
ZEO patch by Jim Fulton (for both CVE-2009-0668 and CVE-2009-0669)

Comment 4 Tomas Hoger 2009-08-06 13:27:51 UTC

Public now via:

http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html

A new release of ZODB is available here:

  http://pypi.python.org/pypi/ZODB3/3.8.2

  (There is also a new development release at
   http://pypi.python.org/pypi/ZODB3/3.9.0b5.)

New Zope releases that include the fixes can be found here:

  http://www.zope.org/Products/Zope/2.10.9
  http://www.zope.org/Products/Zope/2.11.4
  http://www.zope.org/Products/Zope/2.8.11
  http://www.zope.org/Products/Zope/2.9.11
  http://www.zope.org/Products/Zope3/3.1.1
  http://www.zope.org/Products/Zope3/3.2.4
  http://www.zope.org/Products/Zope3/3.3.3
  http://www.zope.org/Products/Zope3/3.4.1

Comment 5 Tomas Hoger 2009-08-06 13:32:12 UTC

conga (Remote Management System used by Red Hat Cluster Suite) uses zope, but does not ship ZEO/ZODB component and hence is not affected by this problem.

zope is currently only part of EPEL5 (2.10.7).

Comment 6 Jonathan Steffan 2009-08-07 04:25:39 UTC

http://koji.fedoraproject.org/koji/taskinfo?taskID=1588264

Comment 7 Fedora Update System 2009-11-10 03:22:08 UTC

zope-2.10.9-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.