Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 24 May 2013 09:53:27 +0100
From: Matthew Wilkes <matthew@...thewwilkes.co.uk>
To: oss-security@...ts.openwall.com
Subject: Re: plone, rrdtool, zenoss bugs

On 2013-04-18 21:08, Kurt Seifried wrote:
> Was this previously exploitable, or is this just a hardening measure?

Hi, Plone checking in here. Sorry, didn't see this until the ping just now.

This is technically a bug in PluggableAuthService, an optional part of 
Zope that we use. In a correctly set up Plone site this won't be 
accessible, but if people are using an account that's set up to access 
the Zope management interface (such as the initial admin user created on 
install) then it would be.

We discourage people from using these users specifically because the 
administration forms that make up the ZMI are not high quality. We're 
looking into longer term solutions to make it safer, but the advice 
right now is to stick with the Site Administrator role we added in Plone 
4.1 or the Editor/Contributor/Reviewer roles that we've always had.

There is no valid reason for anyone to be logged in as a user that could 
access these forms on a production system.

Matt


Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.