----------------------------------------------------------------------

Do you have VARM strategy implemented?

(Vulnerability Assessment Remediation Management)  

If not, then implement it through the most reliable vulnerability
intelligence source on the market. 

Implement it through Secunia. 

For more information visit:
http://secunia.com/advisories/business_solutions/

Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com

----------------------------------------------------------------------

TITLE:
Django Development Service Arbitrary File Access

SECUNIA ADVISORY ID:
SA36137

VERIFY ADVISORY:
http://secunia.com/advisories/36137/

DESCRIPTION:
A vulnerability has been reported in Django, which can be exploited
by malicious, local users to gain knowledge of potentially sensitive
information.

An error in the included lightweight, WSGI-based web server when
mapping certain URLs to corresponding static media files used by the
Django administrative application can be exploited via a specially
crafted URL to read arbitrary files.

Successful exploitation either requires local access to the system as
the service by default  listens on the local interface only or that
the service has been configured to listen on an external interface
(warned against in the documentation as the service is not considered
secure enough).

The vulnerability is reported in Django development trunk, Django
1.0, and Django 0.96. Other versions may also be affected.

SOLUTION:
Update to version 0.96.4 or 1.0.3.

NOTE: The 0.96 release series is now considered end-of-life; version
0.96.4 is therefore the last release in the series.

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
http://www.djangoproject.com/weblog/2009/jul/28/security/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------