The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of BlueBream

vulnerability note 18054

Zope Management Interface: Cross Site Request Forgery

Synthesis of the vulnerability

An attacker can trigger a Cross Site Request Forgery of Zope Management Interface, in order to force the victim to perform operations.
Impacted products: Zope 2, BlueBream.
Severity: 2/4.
Creation date: 07/10/2015.
Identifiers: VIGILANCE-VUL-18054.

Description of the vulnerability

The Zope Management Interface product offers a web service.

However, the origin of queries is not checked. They can for example originate from an image included in an HTML document.

An attacker can therefore trigger a Cross Site Request Forgery of Zope Management Interface, in order to force the victim to perform operations.
Complete Vigil@nce bulletin.... (Free trial)

computer vulnerability note CVE-2012-5485 CVE-2012-5486 CVE-2012-5487

Zope: several vulnerabilities

Synthesis of the vulnerability

Several vulnerabilities of Zope were announced.
Impacted products: RHEL, Zope 2, BlueBream.
Severity: 2/4.
Creation date: 12/11/2012.
Identifiers: 20121106, CVE-2012-5485, CVE-2012-5486, CVE-2012-5487, CVE-2012-5488, CVE-2012-5489, CVE-2012-5490, CVE-2012-5491, CVE-2012-5492, CVE-2012-5493, CVE-2012-5494, CVE-2012-5495, CVE-2012-5496, CVE-2012-5497, CVE-2012-5498, CVE-2012-5499, CVE-2012-5500, CVE-2012-5501, CVE-2012-5502, CVE-2012-5503, CVE-2012-5504, CVE-2012-5505, CVE-2012-5506, CVE-2012-5507, CVE-2012-5508, CVE-2012-6661, RHSA-2014:1194-01, VIGILANCE-VUL-12129.

Description of the vulnerability

A hotfix was published for Plone, a CMS based on Zope.

Several corrected vulnerabilities also impact Zope.

Technical details are unknown.
Complete Vigil@nce bulletin.... (Free trial)

computer vulnerability 10015

ZODB: denial of service on Mac OS X

Synthesis of the vulnerability

When Zope Object Database is installed on Mac OS X, an attacker can interrupt the network session, in order to stop the service.
Impacted products: Zope 2, BlueBream.
Severity: 1/4.
Creation date: 12/10/2010.
Identifiers: BID-43916, VIGILANCE-VUL-10015.

Description of the vulnerability

The ZODB (Zope Object Database) product stores Python objects in a database. These objects can be stored in a remote database, via the ZEO (Zope Enterprise Objects) protocol.

The Python socket.accept() function is called after the TCP handshake, to initialize the session socket, newly created by the client. If the client sends a TCP RST after the end of the handshake, the socket.accept() function returns "None". However, ZODB does not handle this case, and it stops.

When Zope Object Database is installed on Mac OS X, an attacker can therefore interrupt the network session, in order to stop the service.
Complete Vigil@nce bulletin.... (Free trial)

computer vulnerability alert CVE-2009-2701

Zope: file access via ZODB ZEO

Synthesis of the vulnerability

An attacker can connect to the ZODB ZEO server, in order to read or delete files on the system.
Impacted products: Zope 2, BlueBream.
Severity: 3/4.
Creation date: 01/09/2009.
Identifiers: BID-36283, CVE-2009-2701, VIGILANCE-VUL-8986.

Description of the vulnerability

The ZODB (Zope Object Database) product stores Python objects in a database. These objects can be stored in a remote database, via the ZEO (Zope Enterprise Objects) protocol.

Since version 3.8, ZODB supports "blobs" which are binary blocks, stored in files.

When:
 - ZEO shares a database between several applications, and
 - if blobs are enabled
then an attacker allowed to connect via ZEO can directly read or delete files located outside the blob storage directory.

An attacker can therefore connect to the ZODB ZEO server, in order to read or delete files on the system.
Complete Vigil@nce bulletin.... (Free trial)

vulnerability announce CVE-2009-0668 CVE-2009-0669

Zope: vulnerabilities of ZODB ZEO

Synthesis of the vulnerability

Two vulnerabilities of ZODB ZEO can be used by an attacker to execute code on a server.
Impacted products: Debian, NLD, OES, openSUSE, SLES, Zope 2, BlueBream.
Severity: 3/4.
Creation date: 06/08/2009.
Identifiers: BID-35987, CERTA-2009-AVI-319, CVE-2009-0668, CVE-2009-0669, DSA-1863-1, DSA-2234-1, SUSE-SR:2009:020, VIGILANCE-VUL-8922.

Description of the vulnerability

The ZODB (Zope Object Database) product stores Python objects in a database. These objects can be stored in a remote database, via the ZEO (Zope Enterprise Objects) protocol. Two vulnerabilities impact this protocol.

An attacker can use malicious objects in order to execute code on the storage server. [severity:3/4; CERTA-2009-AVI-319, CVE-2009-0668]

An attacker can bypass the authentication of ZODB ZEO, and thus access to the database. [severity:3/4; CVE-2009-0669]

An attacker on the local network can therefore connect to the server via the ZEO protocol, in order to execute code.
Complete Vigil@nce bulletin.... (Free trial)

vulnerability announce CVE-2006-3458

Zope: information disclosure via reStructuredText

Synthesis of the vulnerability

An attacker can use reStructuredText data in order to read files from system.
Impacted products: Debian, openSUSE, Zope 2, BlueBream.
Severity: 2/4.
Creation date: 06/07/2006.
Identifiers: CERTA-2002-AVI-034, CERTA-2006-AVI-304, CVE-2006-3458, DSA-1113-1, Hotfix-20060705, Hotfix-2006-07-05, SUSE-SR:2006:019, VIGILANCE-VUL-5982.

Description of the vulnerability

The Docutils package manipulates text documents. Its reStructuredText component generates documents from a markup language.

The "raw" directive of reStructuredText inserts raw data without honoring markups. For example:
  raw:: html (followed by HTML data)
  raw:: file:/directory/file
This directive thus permits to read a file. The Docutils documentation recommends to deactivate it. However, Zope2 does not deactivate it.

An attacker allowed to input reStructuredText data can therefore read files from system.
Complete Vigil@nce bulletin.... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about BlueBream: