Rapid7 Vulnerability & Exploit Database

RHSA-2002:202: Updated python packages fix predictable temporary file

Back to Search

RHSA-2002:202: Updated python packages fix predictable temporary file

Severity
5
CVSS
(AV:L/AC:L/Au:N/C:P/I:P/A:P)
Published
10/04/2002
Created
07/25/2018
Added
10/28/2005
Modified
07/04/2017

Description

An insecure use of a temporary file has been found in Python. This erratum provides updated Python packages. [updated Feb 12 2003] Updated packages for Red Hat Linux 7.3 are available that fix a binary incompatibility change in the original erratum packages that affected redhat-config-users, and to add back the missing python-tools package. [Updated 16 April 2003] Added packages for Red Hat Linux on IBM iSeries and pSeries systems.

Python is an interpreted, interactive, object-oriented programming language. Zack Weinberg discovered that os._execvpe from os.py in Python 2.2.1 and earlier creates temporary files with predictable names. This could allow local users to execute arbitrary code via a symlink attack. All users should upgrade to these errata packages, which contain a patch to python 1.5.2 and are not vulnerable to this issue. Please note that for Red Hat Linux 7.3 we have updated the python2 packages from version 2.2 to version 2.2.2. Red Hat Linux 8.0 shipped a version of Python that already contained a fix for this issue and is therefore not vulnerable to this issue.

Solution(s)

  • redhat-upgrade-python
  • redhat-upgrade-python-devel
  • redhat-upgrade-python-docs
  • redhat-upgrade-python-tools
  • redhat-upgrade-python2
  • redhat-upgrade-python2-devel
  • redhat-upgrade-python2-docs
  • redhat-upgrade-tkinter
  • redhat-upgrade-tkinter2

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;