GLSA-200505-14 : Cheetah: Untrusted module search path

medium Nessus Plugin ID 18338

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-200505-14 (Cheetah: Untrusted module search path)

Brian Bird discovered that Cheetah searches for modules in the world-writable /tmp directory.
Impact :

A malicious local user could place a module containing arbitrary code in /tmp, which when imported would run with escalated privileges.
Workaround :

There are no known workarounds at this time.

Solution

All Cheetah users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=dev-python/cheetah-0.9.17_rc1'

See Also

https://secuniaresearch.flexerasoftware.com/advisories/15386/

https://security.gentoo.org/glsa/200505-14

Plugin Details

Severity: Medium

ID: 18338

File Name: gentoo_GLSA-200505-14.nasl

Version: 1.16

Type: local

Published: 5/19/2005

Updated: 1/6/2021

Supported Sensors: Nessus

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:cheetah, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Patch Publication Date: 5/19/2005

Reference Information

GLSA: 200505-14