[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 24 May 2013 09:53:27 +0100
From: Matthew Wilkes <matthew@...thewwilkes.co.uk>
To: oss-security@...ts.openwall.com
Subject: Re: plone, rrdtool, zenoss bugs
On 2013-04-18 21:08, Kurt Seifried wrote:
> Was this previously exploitable, or is this just a hardening measure?
Hi, Plone checking in here. Sorry, didn't see this until the ping just now.
This is technically a bug in PluggableAuthService, an optional part of
Zope that we use. In a correctly set up Plone site this won't be
accessible, but if people are using an account that's set up to access
the Zope management interface (such as the initial admin user created on
install) then it would be.
We discourage people from using these users specifically because the
administration forms that make up the ZMI are not high quality. We're
looking into longer term solutions to make it safer, but the advice
right now is to stick with the Site Administrator role we added in Plone
4.1 or the Editor/Contributor/Reviewer roles that we've always had.
There is no valid reason for anyone to be logged in as a user that could
access these forms on a production system.
Matt
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
