Skip to Content.
Sympa Menu

sm-security - [SM-Security] cheetah: Untrusted module search path

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas Houssin <Thomas.Houssin AT gmail.com>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] cheetah: Untrusted module search path
  • Date: Sat, 21 May 2005 20:52:12 +0200

Synopsis
========
Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before
using the paths in the PYTHONPATH variable, which allows local users to
execute arbitrary code via a malicious module in /tmp/.

Background
==========
Cheetah is a Python powered template engine and code generator.

Description
===========
CAN-2005-1632 :
Brian Bird has reported a vulnerability in Cheetah, which can be
exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to Cheetah searching for modules in the
world-writable "/tmp" directory before looking in the PythonPath when
importing modules. This can be exploited to execute arbitrary code with
escalated privileges by placing a malicious module in the "/tmp" directory.


Affected packages
=================
cheetah in all grimoires is affected.
This is now fixed in devel, test, stable-rc and stable grimoire.

Resolution
==========
All cheetah users should upgrade to the latest available version:
#scribe update
#cast -c cheetah

--
Thomas Houssin

Security Team Lead : Source Mage GNU/Linux http://www.sourcemage.org
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature



  • [SM-Security] cheetah: Untrusted module search path, Thomas Houssin, 05/21/2005

Archive powered by MHonArc 2.6.24.

Top of Page