easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does
    not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute
    arbitrary code via a crafted response to the default use of the product. (CVE-2013-1633)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does     not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute     arbitrary code via a crafted response to the default use of the product. (CVE-2013-1633)

Note that Nessus relies on the presence of the package as reported by the vendor.

python-setuptools so far used only HTTP to retrieve packages, which could have lead to man in the middle attacks on newly installed python code.

This update adjusts it to use HTTPS, guaranteeing better connection integrity.

The remote host is affected by the vulnerability described in GLSA-201310-09 (Setuptools: Man-in-the-Middle attack)

    Setuptools does not check the integrity of downloaded Python packages.
  Impact :

    A remote attacker could perform man-in-the-middle attacks to execute       arbitrary code with the privileges of the process.
  Workaround :

    There is no known workaround at this time.

A vulnerability has been discovered and corrected in python-setuptools/python-virtualenv :

easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product (CVE-2013-1633).

The updated python-setuptools packages has been upgraded to the 0.9.8 version and the python-virtualenv packages has been upgraded to the 1.10.1 version which is not vulnerable to this issue.

From upstream :

  - Upgraded pip to v1.4.1

    - Upgraded setuptools to v0.9.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
433721	SCA: security update for setuptools (GHSA-27x4-j476-jp5f)	Tenable Cloud Security	SCA Checks	Local	high
433721	SCA: security update for setuptools (GHSA-27x4-j476-jp5f)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
218020	Linux Distros Unpatched Vulnerability : CVE-2013-1633	Nessus	Misc.	Local	critical
73512	SuSE 11.3 Security Update : python-setuptools (SAT Patch Number 9116)	Nessus	SuSE Local Security Checks	Local	medium
70382	GLSA-201310-09 : Setuptools: Man-in-the-Middle attack	Nessus	Gentoo Local Security Checks	Local	medium
69822	Mandriva Linux Security Advisory : python-setuptools (MDVSA-2013:227)	Nessus	Mandriva Local Security Checks	Local	medium
69782	Fedora 19 : python-virtualenv-1.10.1-1.fc19 (2013-14891)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2013-1633

high

Tenable Plugins

high

high

critical

medium

medium

medium

medium