REDHAT-BUG-481572: Low severity Gnumeric Gnumeric vulnerability
Untrusted search path vulnerability in the GObject wrapper around Python interpreter allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySysSetArgv function.
References (more details, test case): http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Relevant part of the code in gnumeric-N.V.R/plugins/python-loader/gnm-py-interpreter.c:
103 PySysSetArgv (GNELEMENTS (pluginargv) - 1, pluginargv); 104 pyinitgnumeric (interpreter);
Proposed patch: The Debian patch for similar dia's Python related issue, available at:
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=pythonpath.diff;att=1;bug=504251
should be sufficient to resolve this issue.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running Gnumeric in a directory that contains attacker-controlled Python files are exposed. Exploitation is local and depends on the user opening or otherwise invoking the affected Python interpreter wrapper while that directory is the current working directory.
What does an attacker need to exploit it?
An attacker needs the ability to place a Trojan horse Python file in the victim's current working directory. The vulnerability results from the wrapper adding that directory to Python's import search path through PySys_SetArgv.
What can be done if patching is not immediately possible?
Avoid running Gnumeric from directories where untrusted users can create or modify files, and remove or review unexpected Python files in working directories. The referenced proposed fix is a Python search-path patch similar to one used for a related issue.