CVE-2008-5985: Medium severity Gnome Epiphany vulnerability
Untrusted search path vulnerability in Epiphany's Python interface allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySysSetArgv function.
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504363
Test case available in: http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Proposed patch: http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=sanitizesys.path.diff;att=1;bug=504363
Patch notes: The path for affected file in Fedora is BUILD/epiphany-N.V.R/src/ephy-python.c, the proposed patch won't apply cleanly, but the change of:
++ / Sanitize sys.path to prevent relative imports loading modules in ++ the current working directory ++ / ++ PyRunSimpleString("import sys; sys.path = filter(None, sys.path)")
in ephy-python.c should be enough to fix this issue.
Other sources
Untrusted search path vulnerability in the Python interface in Epiphany 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySysSetArgv function (CVE-2008-5983).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In BUILD/epiphany-N.V.R/src/ephy-python.c, add a call to PyRun_SimpleString("import sys; sys.path = filter(None, sys.path)") to sanitize sys.path (remove empty entries) so the current working directory is not searched for imports.
GNOME Epiphany (ephy-python.c) sys.path = filter(None, sys.path)
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5985?
CVE-2008-5985 is classified as a high severity vulnerability due to its potential to allow arbitrary code execution by local users.
How do I fix CVE-2008-5985?
To mitigate CVE-2008-5985, ensure that the Epiphany browser is updated to the latest version where the issue is resolved.
Who is affected by CVE-2008-5985?
Users running Epiphany version 2.22.3 are affected by CVE-2008-5985.
What type of vulnerability is CVE-2008-5985?
CVE-2008-5985 is an untrusted search path vulnerability related to the Python interface in Epiphany.
Can CVE-2008-5985 be exploited remotely?
No, CVE-2008-5985 requires local user access to exploit the vulnerability.