virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink
    attack on a certain file in /tmp/. (CVE-2011-4617)

The remote host is affected by the vulnerability described in GLSA-201206-17 (virtualenv: Insecure temporary file usage)

    The virtualenv.py script in virtualenv does not handle temporary files       securely.
  Impact :

    A local attacker could perform symlink attacks to overwrite arbitrary       files with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

This update fixes :

  - Bug #769067 - CVE-2011-4617 python-virtualenv XSS

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
434994	SCA: security update for virtualenv (GHSA-3jhc-wjqf-5f2c)	Tenable Cloud Security	SCA Checks	medium
434994	SCA: security update for virtualenv (GHSA-3jhc-wjqf-5f2c)	Tenable Self-Hosted Container Security	SCA Checks	medium
59670	GLSA-201206-17 : virtualenv: Insecure temporary file usage	Nessus	Gentoo Local Security Checks	low
57439	Fedora 15 : python-virtualenv-1.7-1.fc15 (2011-17341)	Nessus	Fedora Local Security Checks	low
57438	Fedora 16 : python-virtualenv-1.7-1.fc16 (2011-17289)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2011-4617

medium

Tenable Plugins

medium

medium

low

low

low