Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 27 Jun 2013 10:31:25 -0400 (EDT)
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
        Ralph Loader <suckfish@...g.co.nz>
Subject: CVE Request --  python-suds: Insecure temporary directory use when
 initializing file-based URL cache

Hello Kurt, Steve, vendors,

  based on the public Red Hat Bugzilla report:
  [1] https://bugzilla.redhat.com/show_bug.cgi?id=978696

by Ralph Loader:

A insecure temporary directory use flaw was found in the way
python-suds, a Python SOAP web services client library, performed
initialization of its internal file-based URL cache (predictable
location was used for directory to store the cached files). A
local attacker could use this flaw to conduct symbolic link
attacks, possibly leading to their ability for example the
SOAP .wsdl metadata to redirect queries to a different host,
than originally intended.

The reasons for the current behaviour are detailed at:
[2] https://bugzilla.redhat.com/show_bug.cgi?id=978696#c4

Could you allocate a CVE id for this?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

P.S.: There doesn't seem to be an upstream patch available yet (afaik),
      but the fix is obvious - use more unpredictable routine
      for file-based URL cache directory location generation than
      Python's tempfile.gettempdir() (which is case tempfile.tempdir
      is None, defaults to '/tmp').

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.