Untrusted search path vulnerability in python-paste-script (aka paster) in Luci 0.26.0, when started using the initscript, allows local users to gain privileges via a Trojan horse .egg-info file in the (1) current working directory or (2) its parent directories.

Updated luci packages that fix two security issues, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Luci is a web-based high availability administration application.

A flaw was found in the way the luci service was initialized. If a system administrator started the luci service from a directory that was writable to by a local user, that user could use this flaw to execute arbitrary code as the root or luci user. (CVE-2013-4482)

A flaw was found in the way luci generated its configuration file. The file was created as world readable for a short period of time, allowing a local user to gain access to the authentication secrets stored in the configuration file. (CVE-2013-4481)

These issues were discovered by Jan Pokorny of Red Hat.

These updated luci packages include numerous bug fixes and two enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes.

All luci users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements. After installing this update, the luci service will be restarted automatically.

A flaw was found in the way the luci service was initialized. If a system administrator started the luci service from a directory that was writable to by a local user, that user could use this flaw to execute arbitrary code as the root or luci user. (CVE-2013-4482)

A flaw was found in the way luci generated its configuration file. The file was created as world readable for a short period of time, allowing a local user to gain access to the authentication secrets stored in the configuration file. (CVE-2013-4481)

After installing this update, the luci service will be restarted automatically.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2013:1603 advisory.

    Luci is a web-based high availability administration application.

    A flaw was found in the way the luci service was initialized. If a system     administrator started the luci service from a directory that was writable     to by a local user, that user could use this flaw to execute arbitrary code     as the root or luci user. (CVE-2013-4482)

    A flaw was found in the way luci generated its configuration file. The file     was created as world readable for a short period of time, allowing a local     user to gain access to the authentication secrets stored in the     configuration file. (CVE-2013-4481)

    These issues were discovered by Jan Pokorn of Red Hat.

    These updated luci packages include numerous bug fixes and two     enhancements. Space precludes documenting all of these changes in this     advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical     Notes, linked to in the References, for information on the most significant     of these changes.

    All luci users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues and add these     enhancements. After installing this update, the luci service will be     restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
79165	CentOS 6 : luci (CESA-2013:1603)	Nessus	CentOS Local Security Checks	medium
71195	Scientific Linux Security Update : luci on SL6.x i386/x86_64 (20131121)	Nessus	Scientific Linux Local Security Checks	medium
71008	RHEL 6 : luci (RHSA-2013:1603)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2013-4482

high

Tenable Plugins

medium

medium

high