Overview

A review of differences between the restricted code implemtations in the Zope 2.7 branc and the Zope 2.8 branch revealed a potential exploit involving classes defined in untrusted code (i.e., PythonScripts). Malicious users who are allowed to write through-the-web PythonScripts may be able to gain access to protected methods of those classes exposed for import by untrusted code.

If exploited, this vulnerability could allow users to bypass restrictions which would normally prevent them from viewing and or modifying protected data within the Zope application server.

By default, a stock Zope instance exposes no classes with protected methods for such imports, and thus is not vulnerable to the exploit. Third-party products or local development may have exposed other classes for import by untrusted code: a site with such add-ons installed may therefore be vulnerable to this exploit.

This hotfix product removes the possible exploit, which affects Zope 2.7.5 and earlier, as well as Zope 2.8a2 and earlier on the current development trunk. We recommend installing this hotfix or upgrading to one of the unaffected versions as soon as feasible.

The issue addressed by this hotfix will be closed in Zope versions 2.7.6 and 2.8b1.

Installing the Hotfix

This hotfix is installed as a standard Zope2 product. The following examples assume that your Zope instance is located at '/var/zope/instance': please adjust according to your actual instance path. Also note that hotfix products are not intended for installation into the "software home" of your Zope.

1. Unpack the tarball / zipfile for the Hotfix into a temporary location:

           $ cd /tmp
           $ tar xzf ~/Hotfix_20050405.tar.gz
   

2. Copy or move the product directory from the unpacked directory to the Products directory of your Zope instance:

           $ cp -a /tmp/Hotfix_20050405/ /var/zope/instance/Products/
   

3. Restart Zope:

           $ /var/zope/instance/bin/zopectl restart
   

Uninstalling the Hotfix

After upgrading Zope to one of the fixed versions, you should remove this hotfix product from your Zope instance.

1. Remove the product directory from your instance 'Products':

           $ rm -rf /var/zope/instance/Products/Hotfix_20050405/
   

2. Restart Zope:

           $ /var/zope/instance/bin/zopectl restart