Bug 854011 - (CVE-2012-5659) CVE-2012-5659 abrt: Arbitrary Python code execution due improper sanitization of the PYTHONPATH environment variable by installing debuginfo packages into cache
CVE-2012-5659 abrt: Arbitrary Python code execution due improper sanitization...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
Martin Kyral
: Security
Depends On: 895442 895443 906280
Blocks: 887869
  Show dependency treegraph
Reported: 2012-09-03 10:45 EDT by Jan Lieskovsky
Modified: 2015-08-19 05:18 EDT (History)
5 users (show)

See Also:
Fixed In Version: abrt 2.0.13
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2012-09-03 10:45:58 EDT
An insufficient environment sanitization flaw was found in the way 'abrt-action-install-debuginfo-to-abrt-cache' tool, performing installation of required debuginfo packages into ABRT's cache, of ABRT, an automatic bug detection and reporting tool, used the PYTHONPATH environment variable. A local attacker could provide a commonly used Python module with specially-crafted content in non-standard system location / path, which would lead into arbitrary Python code execution with privileges of the 'abrt' user, when the 'abrt-action-install-debuginfo-to-abrt-cache' tool was run from the parent directory of the folder, containing the malicious module.

Issue found by: Miloslav Trmač of Red Hat
Comment 2 Jan Lieskovsky 2012-09-03 10:51:36 EDT
This issue affects the version of the abrt package, as shipped with Red Hat Enterprise Linux 6.


This issue affects the versions of the abrt package, as shipped with Fedora release of 16 and 17.
Comment 5 Huzaifa S. Sidhpurwala 2012-12-20 05:00:00 EST
Upstream patch:

Comment 7 Jan Lieskovsky 2013-01-24 10:24:57 EST
The preliminary embargo date for this issue has been set up to next Wednesday, 30-th January of 2013.
Comment 8 Murray McAllister 2013-01-30 01:15:57 EST

This issue was discovered by Miloslav Trmač of Red Hat.
Comment 9 Huzaifa S. Sidhpurwala 2013-01-31 06:01:46 EST
Created abrt tracking bugs for this issue

Affects: fedora-all [bug 906280]
Comment 10 errata-xmlrpc 2013-01-31 16:39:11 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0215 https://rhn.redhat.com/errata/RHSA-2013-0215.html

Note You need to log in before you can comment on or make changes to this bug.