FreeBSD : py-pylons -- Path traversal bug (f5c58fc1-49c0-11dd-b0ba-00163e000016)

This script is Copyright (C) 2008-2013 Tenable Network Security, Inc.


Synopsis :

The remote FreeBSD host is missing a security-related update.

Description :

Pylons team reports :

The error.py controller uses paste.fileapp to serve the static
resources to the browser. The default error.py controller uses
os.path.join to combine the id from Routes with the media path. Routes
prior to 1.8 double unquoted the PATH_INFO, resulting in FileApp
returning files from the filesystem that can be outside of the
intended media path directory.

An attacker can craft URL's which utilize the double escaping to pass
in a name to the error.py controller which contains a leading slash
thus escaping the intended media path and serving files from any
location on the filesystem that the Pylons application has access to.

See also :

http://wiki.pylonshq.com/display/pylonsdocs/0.9.6.2
http://www.nessus.org/u?169b48bb

Solution :

Update the affected package.

Risk factor :

High

Family: FreeBSD Local Security Checks

Nessus Plugin ID: 33420 (freebsd_pkg_f5c58fc149c011ddb0ba00163e000016.nasl)

Bugtraq ID:

CVE ID:

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now