oss-security - CVE Request -- Zope/Plone -- Unspecified vulnerability in Zope v2.12.x and Zope v2.13.x allowing arbitrary code execution

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4E8495EA.4010803@redhat.com>
Date: Thu, 29 Sep 2011 17:59:38 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
CC: oss-security@...ts.openwall.com, Plone Security Team <security@...ne.org>
Subject: CVE Request -- Zope/Plone -- Unspecified vulnerability in Zope v2.12.x
 and Zope v2.13.x allowing arbitrary code execution

Hello Josh, Steve, vendors,

   Plone upstream has published a pre-announcement about a security
flaw, present in Zope v2.12.x and Zope v2.13.x, which could allow
execution of arbitrary code by anonymous users. An authenticated
attacker could provide a specially-crafted web page, which once
visited by an unsuspecting Zope user would lead to arbitrary commands
execution with the privileges of the Zope/Plone service.

References:
[1] http://plone.org/products/plone/security/advisories/20110928
[2] http://secunia.com/advisories/46221/
[3] https://bugzilla.redhat.com/show_bug.cgi?id=742297

Note: The vendor announced the final version of the advisory and
       the patch to be available at 2011-10-04 15:00 UTC at the
       following location:
       [4] http://plone.org/products/plone/security/advisories/20110928

Could you allocate a CVE id for this?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.