Date: Fri, 24 May 2013 09:53:27 +0100 From: Matthew Wilkes <matthew@...thewwilkes.co.uk> To: oss-security@...ts.openwall.com Subject: Re: plone, rrdtool, zenoss bugs On 2013-04-18 21:08, Kurt Seifried wrote: > Was this previously exploitable, or is this just a hardening measure? Hi, Plone checking in here. Sorry, didn't see this until the ping just now. This is technically a bug in PluggableAuthService, an optional part of Zope that we use. In a correctly set up Plone site this won't be accessible, but if people are using an account that's set up to access the Zope management interface (such as the initial admin user created on install) then it would be. We discourage people from using these users specifically because the administration forms that make up the ZMI are not high quality. We're looking into longer term solutions to make it safer, but the advice right now is to stick with the Site Administrator role we added in Plone 4.1 or the Editor/Contributor/Reviewer roles that we've always had. There is no valid reason for anyone to be logged in as a user that could access these forms on a production system. Matt
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.