PT-2009-1030 · Zope+1 · Zodb+1

Published 2009-08-07 · Updated 2022-05-02 · CVE-2009-0669

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Zope Object Database (ZODB) versions prior to 3.8.2

Description The issue concerns multiple vulnerabilities in the ZODB package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, attackers can bypass authentication via vectors involving the ZEO network protocol.

Recommendations For Zope Object Database (ZODB) versions prior to 3.8.2, update to version 3.8.2 or later to resolve the issue. As a temporary workaround, consider disabling ZEO database sharing to minimize the risk of exploitation. Restrict access to the ZEO network protocol to prevent unauthorized access.

Fix

Improper Authentication

Code Injection

Weakness Enumeration

CWE-287

CWE-94

Related Identifiers

BDU:2015-03397

CVE-2009-0669

DSA-1863-1

DSA-2234-1

GHSA-5432-C996-HVHJ

PYSEC-2009-9

Affected Products

Debian

Zodb

References · 17

• http://secunia.com/advisories/36205 · Vendor Advisory
• http://secunia.com/advisories/36204 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03397 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-0669 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0669 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0668 · Security Note
• https://osv.dev/vulnerability/GHSA-5432-c996-hvhj · Vendor Advisory
• http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2009-9 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2009-9.yaml · Note
• https://github.com/zopefoundation/ZODB3 · Note
• http://osvdb.org/56826 · Note
• http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html · Note
• http://vupen.com/english/advisories/2009/2217 · Note
• http://securityfocus.com/bid/35987 · Note