Bug 481614

Summary:	totem: untrusted python modules search path
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	bnocera, bressers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-02-02 14:24:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	482814
Bug Blocks:

Description Jan Lieskovsky 2009-01-26 18:26:12 UTC

Untrusted search path vulnerability in totem's Python language binding
allows local users to execute arbitrary code via a Trojan horse Python file
in the current working directory, related to an erroneous setting of sys.path
by the PySys_SetArgv function.

References (more details, PoC, reasons why this issue can't be fixed in Python):
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html

Proposed patch:
The Debian patch for similar dia's Python related issue,
available at:

http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=pythonpath.diff;att=1;bug=504251

should be sufficient to resolve this issue.

Comment 1 Jan Lieskovsky 2009-01-26 18:27:25 UTC

This issue does NOT affect the version of the totem package, as shipped
with Red Hat Enterprise Linux 5.

=================================================================================

This issue affects the versions of the totem package, as shipped with
Fedora releases of 9, 10 and devel.

Please fix.

Comment 3 Jan Lieskovsky 2009-01-29 11:29:38 UTC

More explanation why this issue wasn't fixed in Python yet, can be
found here:

https://bugzilla.redhat.com/show_bug.cgi?id=482814#c1

here:

https://bugzilla.redhat.com/show_bug.cgi?id=482814#c4

and here:

https://bugzilla.redhat.com/show_bug.cgi?id=482814#c5

Looks like the Python fix won't come anytime soon, so please
fix the issue in the package, till we find the proper Python solution.

Ray Strode's test case to check the work of the fix can be found here:

https://bugzilla.redhat.com/show_bug.cgi?id=481556#c8

Comment 4 Bastien Nocera 2009-02-02 14:24:03 UTC

Not a Totem bug, but a Python one.

Comment 5 Josh Bressers 2010-05-19 17:34:11 UTC

Statement:

This issue does not affect the version of the totem package, as shipped with Red Hat Enterprise Linux 5.