PT-2001-1064 · Zope+1 · Zope+1

Published 2001-05-28 · Updated 2017-10-10 · CVE-2001-1227

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions man versions prior to 1.5i2 Zope versions prior to 2.2.4

Description The issue concerns multiple vulnerabilities in the man package of Red Hat Linux and Zope, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. In Zope, partially trusted users can bypass security controls for certain methods by accessing them through the fmt attribute of dtml-var tags.

Recommendations For man package versions prior to 1.5i2, update to version 1.5i2 or later to resolve the issue. For Zope versions prior to 2.2.4, update to version 2.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the dtml-var tags and the fmt attribute in Zope until a patch is available.

Fix

Related Identifiers

BDU:2015-08160

CVE-2001-1227

Affected Products

Zope

Man

References · 9

• https://bdu.fstec.ru/vul/2015-08160 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2001-1227 · Security Note
• http://redhat.com/support/errata/RHSA-2001-072.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1227 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7271 · Note
• https://rhn.redhat.com/errata/RHSA-2001-072.html · Note
• http://redhat.com/support/errata/RHSA-2001-115.html · Patch, Vendor Advisory
• http://linux-mandrake.com/en/security/2001/MDKSA-2001-080.php3 · Patch, Vendor Advisory
• http://securityfocus.com/bid/3425 · Note