Bug 487704 - (CVE-2009-0367) CVE-2009-0367 wesnoth: Python AI sandbox permits arbitrary code execution
CVE-2009-0367 wesnoth: Python AI sandbox permits arbitrary code execution
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On:
  Show dependency treegraph
Reported: 2009-02-27 10:11 EST by Tomas Hoger
Modified: 2009-04-17 14:21 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2009-02-27 10:11:59 EST
It was reported that Wesnoth's Python AI sandbox does not sufficiently confine campaign AI scripts, possibly allowing arbitrary code execution if user can be tricked to download campaigns from untrusted servers.

Upstream bug report:

Discussion on devel mailinglist:

Current upstream decision seems to be to disable Python AI completely due to their limited use.  This seems to have already been done in 1.5.11:

Similar change should soon appear in 1.4.8 too:
Comment 1 Vincent Danen 2009-03-05 12:21:28 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0367 to
the following vulnerability:

Name: CVE-2009-0367
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0367
Assigned: 20090129
Reference: CONFIRM: http://www.wesnoth.org/forum/viewtopic.php?t=24247
Reference: CONFIRM: http://www.wesnoth.org/forum/viewtopic.php?t=24340
Reference: CONFIRM: https://gna.org/bugs/index.php?13048
Reference: SECUNIA:34058
Reference: URL: http://secunia.com/advisories/34058
Reference: VUPEN:ADV-2009-0595
Reference: URL: http://www.vupen.com/english/advisories/2009/0595

The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows
remote attackers to escape the sandbox and execute arbitrary code by
using a whitelisted module that imports an unsafe module, then using a
hierarchical module name to access the unsafe module through the
whitelisted module.
Comment 2 Niels 2009-04-17 14:21:35 EDT
As there is now Wesnoth 1.6 in f10, that can be marked as fixed, I think.

Note You need to log in before you can comment on or make changes to this bug.