Bug 462694 (CVE-2008-3949)

Chong Yidong has reported the following security vulnerability present
in Emacs Python mode (Emacs mode allowing to launch interactive Python 
shell):

Emacs allows the user to launch an interactive Python process.  When
this process is started, Emacs automatically sends it the line

import emacs

which imports a script named emacs.py which is distributed with Emacs.
This script is typically located in a write-protected installation
directory, together with other Emacs program files; it provides various
functions to help the Python process communicate with Emacs.  Upon
running, emacs.py imports other Python modules which are not built-in:

import os, sys, traceback, inspect, __main__


The vulnerability arises because Python, by default, prepends '' to the
module search path, so modules are looked for in the current directory.
If the user opens a Python file in a world-writable directory, an
attacker could insert malicious code by adding fake modules to that
directory, such as a fake emacs.py or inspect.py.

Affected versions: emacs-22.*. +

Proposed patch: 

http://cvs.savannah.gnu.org/viewvc/emacs/lisp/progmodes/python.el?root=emacs&r1=1.89&r2=1.90