PT-2009-1030 · Zope+1 · Zodb+1

Publicado 2009-08-07 · Atualizado 2022-05-02 · CVE-2009-0669

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Zope Object Database (ZODB) versions prior to 3.8.2

Description The issue concerns multiple vulnerabilities in the ZODB package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, attackers can bypass authentication via vectors involving the ZEO network protocol.

Recommendations For Zope Object Database (ZODB) versions prior to 3.8.2, update to version 3.8.2 or later to resolve the issue. As a temporary workaround, consider disabling ZEO database sharing to minimize the risk of exploitation. Restrict access to the ZEO network protocol to prevent unauthorized access.

Correção

Improper Authentication

Code Injection

Enumeração de Fraquezas

CWE-287

CWE-94

Identificadores relacionados

BDU:2015-03397

CVE-2009-0669

DSA-1863-1

DSA-2234-1

GHSA-5432-C996-HVHJ

PYSEC-2009-9

Produtos afetados

Debian

Zodb

Referências · 17

• https://github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2009-9.yaml · Nota
• https://github.com/zopefoundation/ZODB3 · Nota
• http://osvdb.org/56826 · Nota
• http://secunia.com/advisories/36205 · Aviso do Fabricante
• http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html · Nota
• http://secunia.com/advisories/36204 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-03397 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2009-0669 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0669 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0668 · Nota de Segurança
• http://vupen.com/english/advisories/2009/2217 · Nota
• https://osv.dev/vulnerability/GHSA-5432-c996-hvhj · Aviso do Fabricante
• http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2 · Aviso do Fabricante
• http://securityfocus.com/bid/35987 · Nota
• http://debian.org/security/dsa-2234 · Nota