Debian Security Advisory
zope -- unauthorized escalation of privilege (update)
- Date Reported:
- 21 Aug 2000
- Affected Packages:
- zope
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2000-0725.
- More information:
- On versions of Zope prior to 2.2.1 it was possible for a
user with the ability to edit DTML to gain unauthorized access to extra roles
during a request. A fix was previously announced in the Debian GNU/Linux zope package
2.1.6-5.1, but that package did not fully address the issue and has been
superseded by this announcement. More information is available at http://www.zope.org/Products/Zope/Hotfix_2000-08-17/security_alert.
Debian GNU/Linux 2.1 (slink) did not include zope, and is not vulnerable. Debian GNU/Linux 2.2 (potato) does include zope and is vulnerable to this issue. A fixed package for Debian GNU/Linux 2.2 (potato) is available in zope 2.1.6-5.2.
- Fixed in:
-
Debian GNU/Linux 2.2 (potato)
- Source:
- http://security.debian.org/dists/potato/updates/main/source/zope_2.1.6-5.2.diff.gz
- http://security.debian.org/dists/potato/updates/main/source/zope_2.1.6-5.2.dsc
- http://security.debian.org/dists/potato/updates/main/source/zope_2.1.6.orig.tar.gz
- http://security.debian.org/dists/potato/updates/main/source/zope_2.1.6-5.2.dsc
- alpha:
- http://security.debian.org/dists/potato/updates/main/binary-alpha/zope_2.1.6-5.2_alpha.deb
- arm:
- http://security.debian.org/dists/potato/updates/main/binary-arm/zope_2.1.6-5.2_arm.deb
- i386:
- http://security.debian.org/dists/potato/updates/main/binary-i386/zope_2.1.6-5.2_i386.deb
- m68k:
- http://security.debian.org/dists/potato/updates/main/binary-m68k/zope_2.1.6-5.2_m68k.deb
- powerpc:
- http://security.debian.org/dists/potato/updates/main/binary-powerpc/zope_2.1.6-5.2_powerpc.deb
- sparc:
- http://security.debian.org/dists/potato/updates/main/binary-sparc/zope_2.1.6-5.2_sparc.deb