REDHAT-BUG-481551: Low severity dia vulnerability

Published Jan 26, 2009

Updated

Untrusted search path vulnerability in dia's Python plug-in alows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySysSetArgv function.

References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504251

Test case and more discussion about this issue (and reason's why it can't be fixed in Python is available at): http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html

Proposed patch: http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=pythonpath.diff;att=1;bug=504251

Affected Software

2 affected components

The GNOME Project Dia

Python Software Foundation Python

Event History

Jan 26, 2009

Data Sourced

via Red Hat·10:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-481551?

REDHAT-BUG-481551 is classified as a high-severity vulnerability due to its potential for executing arbitrary code.

How do I fix REDHAT-BUG-481551?

To fix REDHAT-BUG-481551, ensure that the environment is properly configured to prevent the execution of untrusted Python files.

Who is affected by REDHAT-BUG-481551?

Users of Dia and Python, particularly local users, are affected by REDHAT-BUG-481551.

What is the nature of the vulnerability identified in REDHAT-BUG-481551?

REDHAT-BUG-481551 is an untrusted search path vulnerability that allows local execution of arbitrary code.

What are the implications of REDHAT-BUG-481551?

The implications of REDHAT-BUG-481551 include potential unauthorized access and manipulation of systems by executing malicious code.