- Zope-Dev - Zope lists

possible compromise
by Chris Pelton 14 Oct '03

14 Oct '03

>>/ So, would anybody have any ideas how to determine if this might have />>/ been compromised? Or is there a known mail relay exploit through zope />>/ somehow? I've checked system binaries and everything seems fine. None of />>/ the python files seem to have been changed since well before the />>/ relaying started. / >It might help to know the version of zope which you may be able to find >it in the version.txt file distributed with zope releases. That said, >there hasn't been a known relay exploit to the best of my knowledge, >but there are many ways to implement a web application that sends mail >in zope, and it wouldn't be at all surprising if the implementation of >your system was vulnerable. >Do you know enough about Zope to discuss the implementation of your >web application? We can throw out a bazillion ideas but thats a >painfully slow way to determine what really happened. Unfortunately I don't know much about zope. There are several version.txt files in the tree - ./lib/python/version.txt - yields Zope 2.2.5 (source release, python 1.5.2, linux2) but there is also a Zope-2.3.3-src directory, although I don't find any binaries in there that match what look to be the running binaries. The thing is, this machine had sendmail configure for no-relay, but there were several virtual hosts in apache, and the mail was coming from one of those hosts. I'm thinking they could have just taken advantage of some Zope functionality, not necessarily a break-in? Thanks again, Chris

5 6

possible compromise
by Chris Pelton 14 Oct '03

14 Oct '03

Hello, I'm trying to do some forensics on a redhat 6.2 box that was somehow turned into a mail relay and may have been compromised. The mail logs show the mail coming from an apache virtual host address, and this machine was running zope, and the list of hotfix files I see is: 5220 May 25 2001 Hotfix_2000-10-02.tar.gz 2800 May 25 2001 Hotfix_2000-10-11.tgz 3002 May 25 2001 Hotfix_2000-12-08.tgz 2839 May 25 2001 Hotfix_2000-12-15a.tgz 2386 May 25 2001 Hotfix_2000-12-18.tgz 1899 May 25 2001 Hotfix_2001-02-23.tgz 3292 May 25 2001 Hotfix_2001-03-08.tgz 2492 May 25 2001 Hotfix_2001-05-01.tgz 30720 May 25 2001 hotfix.tar So, would anybody have any ideas how to determine if this might have been compromised? Or is there a known mail relay exploit through zope somehow? I've checked system binaries and everything seems fine. None of the python files seem to have been changed since well before the relaying started. Not sure what version of zope this is - it was built locally, not an rpm. Thanks in advance, Chris Pelton

4 3

RE: [Zope-dev] relations in objects
by Bjorn Stabell 10 Oct '03

10 Oct '03

> From: Paul Winkler [mailto:pw_lists@slinkp.com] >> On Thu, Oct 09, 2003 at 08:46:24PM -0700, Jason Corbett wrote: >> How does an object in zope know where it sits in the hirearchy, > > The only unique identifier that zope provides is > the containment path. An object can tell you its containment > path by doing foo.absolute_url(1) or foo.getPhysicalPath() > depending on what form you want the output in. I am often confused by this as well. I think, however, that you can also reach objects by its "object id" oid. If I just use simple assignment of a variable to an object in Zope, I get that object's oid, right?

3 2

Initial ZODB permissions
by Andy McKay 10 Oct '03

10 Oct '03

Where is the initial code for setting permissions in the ZODB? It looks like the "Copy or Move" permission is give to Anonymous by default at ZODB creation in Zope, which is ahem wrong. Cant find the code that sets that up though, can anyone throw me a clue stick that grep can't? Thanks. -- Andy McKay ClearWind Consulting http://www.clearwind.ca

4 5

Creative Commons Support
by Wouter Vanden Hove 09 Oct '03

09 Oct '03

Are there any plans or is there any interest in supporting the Creative Commons Licenses for metadata in Zope-documents? Has there ever been any talk of such a product? Examples of applications with built-in CC support: http://creativecommons.org/technology/ccapps Greets, Wouter Vanden Hove www.open-education.org

1 0

Re: CVS: Zope/doc/PLATFORMS - BSD.txt:1.1.2.1
by Jochen Knuth 08 Oct '03

08 Oct '03

Hi, Chris McDonough schrieb: > Update of /cvs-repository/Zope/doc/PLATFORMS > In directory cvs.zope.org:/tmp/cvs-serv28347 > > Added Files: > Tag: Zope-2_7-branch > BSD.txt > Log Message: > Add thread stack size fix docs by Andrew Sawyers. > > > === Added File Zope/doc/PLATFORMS/BSD.txt === > Steps to building python for use with Zope on FreeBSD to avoid > segmentation faults (by Andrew Sawyers for Pythons up to 2.3). > > The default thread stack size for FreeBSD is too small; when building > Python for use with Zope it is often necessary to increase the thread > stack size to avoid segmentation faults. There are two ways which you > can increase the default python thread stack size. > > Way #1: In your Python source directory: > > Way #2: In your Python source directory: Way #3: Use Python from the ports system (the fixes are there since 06 Feb 2003 ) Ciao, Jochen -- -------------------------------------------------- Jochen Knuth WebMaster http://www.ipro.de IPRO GmbH Phone ++49-7152-93330 Steinbeisstr. 6 Fax ++49-7152-933340 71229 Leonberg EMail: J.Knuth(a)ipro.de

2 1

catalogObject changes (Zope-2_6-branch)
by Yuppie 08 Oct '03

08 Oct '03

Hi! Yesterday I spent some hours tracking down why catalog Metadata and catalog Indexes are getting out of sync in my CMF Site. I found that checkin <http://cvs.zope.org/Zope/lib/python/Products/ZCatalog/Catalog.py.diff?r1=1.…> including this new condition <code> if not idxs: # if the caller specifies that we should update only a # specific set of indexes, we don't do a metadata update. self.updateMetadata(object, uid) </code> Could anybody tell me what's the rationale behind that checkin? - it breaks backwards compatibility - it's only in Zope-2_6-branch, not in Zope-2_7-branch or HEAD - I can't see what this 'if' is good for anyway Cheers, Yuppie

6 15

Re: Which version of ZODB and ZEO to use for Zope?
by Dario Lopez-Kästen 08 Oct '03

08 Oct '03

Hi again, and thanks for all the replies. Given that we are going to use this to deploy to production within the coming week, we will stick with Python 2.1.3, Zope 2.6.2 and use ZODB 3.1.4. We will wait for Zope 2.7 to stabilise or reach a 2.7.x version before we switch tp Python 2.3.x and ZODB 3.2. Thank you again for all the responses. /dario - -------------------------------------------------------------------- Dario Lopez-Kästen, IT Systems & Services Chalmers University of Tech.

1 0

Risks with Zope 2.6.2 with Python 2.2.3
by Dario Lopez-Kästen 08 Oct '03

08 Oct '03

Hello, following Jeremy Hylton's advice, I would like to ask the developer community: what risks are associated with Zope 2.6.2 with Pythoin 2.2.3? Thank you, /dario - -------------------------------------------------------------------- Dario Lopez-Kästen, IT Systems & Services Chalmers University of Tech.

2 1

Re: [Zope-dev] Risks with Zope 2.6.2 with Python 2.2.3
by Eric Brun 08 Oct '03

08 Oct '03

Hello, I try to run Zope2.6.2 and ZODB3.2 with python 2.2.3 but it failed. Then I modified a few ZODB3.2 (remove 'object' inherite on some classes like Connection.py DB.py and some others). I have succed to run ZEO and Zope 2.6.2 on python 2.1.3. Perhaps is not so well, but it's run. Is there any risks to do that too ? Thank too Eric > Hello, > > following Jeremy Hylton's advice, I would like to ask the developer > community: > > what risks are associated with Zope 2.6.2 with Pythoin 2.2.3? > > Thank you, > > /dario > > - -------------------------------------------------------------------- > Dario Lopez-Kästen, IT Systems & Services Chalmers University of Tech. > > > _______________________________________________ > Zope-Dev maillist - Zope-Dev(a)zope.org > http://mail.zope.org/mailman/listinfo/zope-dev > ** No cross posts or HTML encoding! ** > (Related lists - > http://mail.zope.org/mailman/listinfo/zope-announce > http://mail.zope.org/mailman/listinfo/zope ) >

1 0