Untrusted search path vulnerability in BPY_interface in Blender 2.46 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySys_SetArgv function.

The remote host is affected by the vulnerability described in GLSA-201001-07 (Blender: Untrusted search path)

    Steffen Joeris reported that Blender's BPY_interface calls     PySys_SetArgv() in such a way that Python prepends sys.path with an     empty string.
  Impact :

    A local attacker could entice a user to run 'blender' from a directory     containing a specially crafted Python module, resulting in the     execution of arbitrary code with the privileges of the user running the     application.
  Workaround :

    There is no known workaround at this time.

It was discovered that Blender did not correctly handle certain malformed Radiance RGBE images. If a user were tricked into opening a .blend file containing a specially crafted Radiance RGBE image, an attacker could execute arbitrary code with the user's privileges.
(CVE-2008-1102)

It was discovered that Blender did not properly sanitize the Python search path. A local attacker could execute arbitrary code by inserting a specially crafted Python file in the Blender working directory. (CVE-2008-4863).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix CVE-2008-4863

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Python has a variable called sys.path that contains all paths where Python loads modules by using import scripting procedure. A wrong handling of that variable enables local attackers to execute arbitrary code via Python scripting in the current Blender working directory (CVE-2008-4863).

This update provides fix for that vulnerability.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

Fix CVE-2008-4863 New upstream release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
44896	GLSA-201001-07 : Blender: Untrusted search path	Nessus	Gentoo Local Security Checks	medium
37828	Ubuntu 6.06 LTS : blender vulnerabilities (USN-699-1)	Nessus	Ubuntu Local Security Checks	medium
37675	Fedora 10 : blender-2.48a-4.fc10 (2008-10448)	Nessus	Fedora Local Security Checks	medium
36763	Mandriva Linux Security Advisory : blender (MDVSA-2009:038-1)	Nessus	Mandriva Local Security Checks	medium
34747	Fedora 9 : blender-2.48a-4.fc9 (2008-9447)	Nessus	Fedora Local Security Checks	medium
34746	Fedora 8 : blender-2.48a-4.fc8 (2008-9411)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-4863

high

Tenable Plugins

medium

medium

medium

medium

medium

medium