The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.

The remote Solaris system is missing necessary patches to address security updates :

  - FileSystemBytecodeCache in Jinja2 2.7.2 does not     properly create temporary directories, which allows     local users to gain privileges by pre-creating a     temporary directory with a user's uid. NOTE: this     vulnerability exists because of an incomplete fix for     CVE-2014-1402. (CVE-2014-0012)

  - The default configuration for     bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2     does not properly create temporary files, which allows     local users to gain privileges via a crafted .cache file     with a name starting with __jinja2_ in /tmp.
    (CVE-2014-1402)

The remote host is affected by the vulnerability described in GLSA-201408-13 (Jinja2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Jinja2. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker could gain escalated privileges via a specially crafted       cache file or  pre-created temporary directory.
  Workaround :

    There is no known workaround at this time.

It was discovered that Jinja2 incorrectly handled temporary cache files and directories. A local attacker could use this issue to possibly gain privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Add patch to fix CVE-2014-1402.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Version 2.7.3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Jinja2 did not properly handle bytecode cache files stored in the system's temporary directory. A local attacker could use this flaw to alter the output of an application using Jinja2 and FileSystemBytecodeCache, and potentially execute arbitrary code with the privileges of that application. (CVE-2014-1402)

For the update to take effect, all applications using python-jinja2 must be restarted.

Updated python-jinja2 packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Jinja2 is a template engine written in pure Python. It provides a Django-inspired, non-XML syntax but supports inline expressions and an optional sandboxed environment.

It was discovered that Jinja2 did not properly handle bytecode cache files stored in the system's temporary directory. A local attacker could use this flaw to alter the output of an application using Jinja2 and FileSystemBytecodeCache, and potentially execute arbitrary code with the privileges of that application. (CVE-2014-1402)

All python-jinja2 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all applications using python-jinja2 must be restarted.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2014-0747 advisory.

    [2.2.1-2]
    - Fix CVE-2014-1402     Resolves: rhbz#1102889

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated python-jinja2 packages fix security vulnerability :

Jinja2, a template engine written in pure python, was found to use /tmp as a default directory for jinja2.bccache.FileSystemBytecodeCache, which is insecure because the /tmp directory is world-writable and the filenames used like 'FileSystemBytecodeCache' are often predictable. A malicious user could exploit this bug to execute arbitrary code as another user (CVE-2014-1402).

ID	Name	Product	Family	Severity
80649	Oracle Solaris Third-Party Patch Update : jinja2 (multiple_vulnerabilities_in_jinja2)	Nessus	Solaris Local Security Checks	medium
78314	Amazon Linux AMI : python-jinja2 (ALAS-2014-371)	Nessus	Amazon Linux Local Security Checks	medium
77457	GLSA-201408-13 : Jinja2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
76785	Ubuntu 12.04 LTS : jinja2 vulnerabilities (USN-2301-1)	Nessus	Ubuntu Local Security Checks	medium
76174	Fedora 19 : python-jinja2-2.6-7.fc19 (2014-7399)	Nessus	Fedora Local Security Checks	medium
76173	Fedora 20 : python-jinja2-2.7.3-1.fc20 (2014-7166)	Nessus	Fedora Local Security Checks	medium
74492	Scientific Linux Security Update : python-jinja2 on SL6.x i386/x86_64 (20140611)	Nessus	Scientific Linux Local Security Checks	medium
74486	RHEL 6 : python-jinja2 (RHSA-2014:0747)	Nessus	Red Hat Local Security Checks	medium
74483	Oracle Linux 6 : python-jinja2 (ELSA-2014-0747)	Nessus	Oracle Linux Local Security Checks	high
74475	CentOS 6 : python-jinja2 (CESA-2014:0747)	Nessus	CentOS Local Security Checks	medium
74074	Mandriva Linux Security Advisory : python-jinja2 (MDVSA-2014:096)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2014-1402

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium