REDHAT-BUG-1062009: Low severity NumPy f2py vulnerability

Published Feb 6, 2014

Updated

Jakub Wilk found that f2py insecurely used a temporary file. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running f2py.

The original report in the Debian bug tracking system (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737778) notes the issue is in numpy/f2py/init.py:

from numpy.distutils.execcommand import execcommand import tempfile if sourcefn is None: fname = os.path.join(tempfile.mktemp()+'.f') else: fname = sourcefn

f = open(fname,'w')

Affected Software

1 affected component

NumPy f2py

Event History

Feb 6, 2014

Data Sourced

via Red Hat·03:53 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1062009?

The severity of REDHAT-BUG-1062009 is considered high due to its potential for local exploitation.

How do I fix REDHAT-BUG-1062009?

To fix REDHAT-BUG-1062009, users should update to the latest version of NumPy f2py that addresses the symbolic link vulnerability.

Who is affected by REDHAT-BUG-1062009?

Users running NumPy f2py may be affected by REDHAT-BUG-1062009 if they allow local untrusted users to interact with the software.

What is the nature of the vulnerability in REDHAT-BUG-1062009?

The vulnerability in REDHAT-BUG-1062009 is a local symbolic link attack that can lead to unauthorized file modifications.

Is there a workaround for REDHAT-BUG-1062009?

A possible workaround for REDHAT-BUG-1062009 is to restrict access to the f2py executable and manage file permissions appropriately.