September 2011 - Zope

Security vulnerabiity 20110928: Arbitrary Code Execution (pre-announcement)
by Tres Seaver 28 Sep '11

28 Sep '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Zope security response team is pre-announcing a fix for a vulnerability in Zope 2.12.x and Zope 2.13.x that allows execution of arbitrary code by anonymous users. This is a severe vulnerability that allows an unauthenticated attacker to employ a carefully crafted web request to execute arbitrary commands with the privileges of the Zope service. Versions Affected: Zope 2.12.x and Zope 2.13.x. Versions Not Affected: Zope 2.9.x, Zope 2.10.x, Zope 2.11.x This is a pre-announcement. Due to the severity of this issue we are providing an advance warning of an upcoming patch, which will be released 2011-10-04 15:00 UTC. What you should do in advance of patch availability =================================================== Due to the nature of the vulnerability, the security team has decided to pre-announce that a fix is upcoming before disclosing the details. This is to ensure that concerned users can plan around the release. As the fix being published will make the details of the vulnerability public, we are recommending that all users plan a maintenance window for 30 minutes either side of the announcement where your site is completely inaccessible in which to install the fix. Meanwhile, we STRONGLY recommend that you take the following steps to protect your site: - - Make sure that the Zope service is running with with minimum privileges. Ideally, the Zope and ZEO services should be able to write only to log and data directories. - - Use an intrusion detection system that monitors key system resources for unauthorized changes. - - Monitor your Zope, reverse-proxy request and system logs for unusual activity. In this case, these are standard precautions that should be employed on any production system. Extra help ========== Should you not have in-house server administrators or a service agreement looking after your website you can find consultancy companies on plone.net. There is also free support available online via Zope mailing lists and the #zope IRC channels. Questions and Answers ===================== Q: When will the patch be made available? A: The Security Team will release the patch at 2011-10-04 15:00 UTC. Q. What will be involved in applying the patch? A. Patches are made available as tarball-style archives that may be unpacked into the “products” folder of a buildout installation and as Python packages that may be installed by editing a buildout configuration file and running buildout. Patching is generally easy and quick to accomplish. Q: How was this vulnerability found? A: This issue was found as part of a routine audit performed by the Plone Security team. Q: My site is highly visible and mission-critical. I hear the patch has already been developed. Can I get the fix before the release date? A: No. The patch will be made available to all users at the same time. There are no exceptions. Q: If the patch has been developed already, why isn't it already made available to the public? A: The Security Team is still testing the patch and running various scenarios thoroughly. The team is also making sure everybody has appropriate time to plan to patch their Zope installation(s). Some consultancy organizations have hundreds of sites to patch and need the extra time to coordinate their efforts with their clients. Q: How does one exploit the vulnerability? A: This information will not be made available until after the patch is made available. Q: Is there a CVE record for this vulnerability? A: Not yet. This information will be added when available. If you have specific questions about this vulnerability or its handling, contact the Zope Security Team, security-response(a)zope.org. To report potentially security-related issues, please send a mail to the Zope Security Team at security-response(a)zope.org. The security team is always happy to credit individuals and companies who make responsible disclosures. Information for vulnerability database maintainers ================================================== CVSS Base Score 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P/E:P/RL:O/RC:C) Impact Subscore 6.4 Exploitability Subscore 10 CVSS Temporal Score 5.9 Credit Alan Hoey Tres. - -- =================================================================== Tres Seaver +1 540-429-0999 tseaver(a)palladion.com Palladion Software "Excellence by Design" http://palladion.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk6DlaMACgkQ+gerLs4ltQ7D+gCgz6WA6J44vxkhjnJGquBzCR33 nPgAn3cl0/do5VB+B6h9WmM22yIGOb7Z =/HcQ -----END PGP SIGNATURE-----

1 0

REST webservice on Zope 2
by Vimal 27 Sep '11

27 Sep '11

Hi all, We need to implement a webservice for our Zope 2 website. Among SOAP and REST, REST appears to be easier to implement for what we need - return json or xml based on the URLs accessed. Zope 3 supports REST (z3c.rest) but not Zope 2. Does somebody have experience implementing REST on Zope 2? Regards, Vimal

2 2

Caipirinha with Zope Sprint in Argentina and Brazil
by Roberto Allende 24 Sep '11

24 Sep '11

Hello Within PyCon Argentina, Plone Symposium South America and PyCon Brazil we will run the "Caipirinha with Zope Sprint" where we'll work on ZTK components migration to Python3 and to integrate webob with Zope. For more information about the sprint visit http://www.pythonbrasil.org.br/2011/programacao/sprints/sprints/zope-e-pyth… For more informatio about PyCon Argentina and PyCon Brazil visit: http://ar.pycon.org/2011 http://www.pythonbrasil.org.br/2011 Lastly i'd like to note that you can join us through irc at #caipirinha on irc.freenode.net You're invited, Cheers! Roberto Allende -- http://robertoallende.com

2 2

MailingLogger 3.5.0 Released!
by Chris Withers 24 Sep '11

24 Sep '11

I'm pleased to announce a new release of Mailinglogger. Mailinglogger provides two handlers for the standard python logging framework that enable log entries to be emailed either as the entries are logged or as a summary at the end of the running process. The handlers have the following features: - customisable and dynamic subject lines for emails sent - emails sent with a configurable headers for easy filtering - flood protection to ensure the number of emails sent is not excessive - support for SMTP servers that require authentication - fully documented and tested The only change for this release was to add an X-Log-Level header to emails sent. For MailingLogger, this is the level of the log message being emailed. For SummarisingLogger this is the highest level of any of the messages handled. Full docs can be found here: http://packages.python.org/mailinglogger/ For more information, please see: http://www.simplistix.co.uk/software/python/mailinglogger or http://pypi.python.org/pypi/mailinglogger cheers, Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk

1 0

zopetime behaviour
by Richard Harley 20 Sep '11

20 Sep '11

Hi all I hope I'm not missing something obvious here. ZopeTime is gaining two hours when it's string formatted. * thistime = context.ZopeTime().strftime("%Y/%m/%d %H:%M:%S") print "ZopeTime:" print context.ZopeTime() print "String formatted ZopeTime:" print thistime * The output is this:* *ZopeTime: 2011/09/20 10:16:12.628 GMT+1 String formatted ZopeTime: 2011/09/20 12:16:12 How come string formatted ZopeTime gains two hours? Cheers Rich

2 1

Issues with programmatically deleting objects
by niveditha j 15 Sep '11

15 Sep '11

Hi All, I am new to Zope, using Zope 2.7 and wrote a "Script Python" to delete objects programatically(used for bulk delete). parent.manage_delObjects(id) After I execute the script using the Test button of the ZMI, the objects are getting deleted properly. But in the Undo tab, I am not able to see the transaction history (/mysite/path/manage_delObjects by *niv)* When I tried to add transaction.commit() the ZMI is asking for credentials. 1. How do I get the transaction recorded using Script Python? 2. Are there any other ways to achieve the same? 3. Another issue is, when I tried to invoke the delete Script Python from an external python script using xmlrpc it threw a xmlrpclib.ProtocolError 401 Unauthorized Error. Is it because there is a manage_delObjects call? Regs, Niv

2 1

OpenID consumer for Zope 2
by Jesus Cea 12 Sep '11

12 Sep '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, everybody. I am looking for a OpenID consumer module for Zope 2. I want to deploy OpenID instead of the clasical user+password. The only requirement is that it must run under Zope 2. Any ideas? Thanks!!. - -- Jesus Cea Avion _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/_/_/_/ . _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQCVAwUBTm1jw5lgi5GaxT1NAQJmEAP+KN8YoN6S/8G9fzv1kOC5ThrnPvTTx14A YO7qCEfnKgPJ0XXLGOL2uvXn72V1Ihp9AxYTfrP+aHyMeY6HJgomWqwViEUDlNpC ETOI6x46x1S2RH6pS4t8gVXhSzmxId5E74O+tiPdh/pKMalxM0vzYanfNFB68OUK qy6fH24aDsc= =xOc7 -----END PGP SIGNATURE-----

1 0

BTreeFolder2 strangeness (invisible objects?)
by knitti 06 Sep '11

06 Sep '11

Hi, I just came across something very strange. We have here a large nested BTreeFolder2 tree, whose leaves contain ExtFiles, e.g. btreef_root/btreef2/btreef3/btree_leave. Many of these leave folders haven't been read since their creation, which could have been up to 3 years ago. During a data migration, which consists of a cut/paste operation of the ExtFile objects into another part of the tree (common root within the same zodb) I ran into a CopyError during manage_cutObjects. Looking for the offending objects in the ZMI didn't show me the leave folder, but calling .objectIds() on its parent did show its name. Also, the leave folder must be there somehow, because the operation is only attempted when its .objectIds() returns something. Accessing the "invisible" folder by direct url raises a NotFound. Condensed code of the migration: v0container = root.unrestrictedTraverse(['the', 'correct', 'path']) file_ids = v0container.objectIds() if file_ids: v1container = create_v1container(precalculated_path) v1container.manage_pasteObjects( v0container.manage_cutObjects(file_ids)) # boom so it seems unrestrictedTraverse() can do something which the ZMI doesn't. User roles contain Manager and Owner, I've tried running the script with Manager and Owner proxy roles. The same code on the same ZODB with the same user has worked some time in the past. Zope version: (Zope 2.11.6-final, python 2.4.5, freebsd8) I would appreciate any idea which data structure I should have a closer look at, to preferrably recover or delete these objects. best regards, knitti

1 0

Upgrading from 2.10 to 2.13
by Michael Shulman 03 Sep '11

03 Sep '11

Hi, I am trying to upgrade an old 2.10 instance to 2.13, and I appear to be having trouble with the Psycopg connection and ZSQL methods. First of all, it took some work to uncover that I had to download the source code for Psycopg in order to get the ZPsycopgDA zope product (easy_install psycopg2 didn't give it to me). Second, it took some more work to uncover that I had to separately install the ZSQLMethods product. I think it would be helpful if these facts would be mentioned at http://docs.zope.org/zope2/zope2book/RelationalDatabases.html which just says "PostgreSQL: The newest and prefered DA is ZPsycopgDA included in psycopg." However, I've gotten past that stage, and I can create database connections and ZSQL methods which seem to work. However, the existing ZSQL methods and/or database connection in my (copied over) old Data.fs are still causing problems. Whenever I try to view a page which calls one of those methods, or even try to navigate in the ZMI to the folder *containing* them, I get the error TypeError: ('argument list must be a tuple', <class 'Shared.DC.ZRDB.DA.SQL'>, None) The only help I've been able to find online is this brief exchange: http://comments.gmane.org/gmane.comp.web.zope.general/63079 which might be helpful to me if I knew what "_p_changed = 1 or some such" meant. Can anyone help? Thanks! Mike

2 2