Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).

- Fri Jan 30 2009 Huzaifa Sidhpurwala <huzaifas at     redhat.com> 1:1.8.2-6

    - Resolves CVE-2008-5983

    - Version bump to match the rawhide version

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Python has a variable called sys.path that contains all paths where Python loads modules by using import scripting procedure. A wrong handling of that variable enables local attackers to execute arbitrary code via Python scripting in the current Gnumeric working directory (CVE-2009-0318).

This update provides fix for that vulnerability.

The remote host is affected by the vulnerability described in GLSA-200904-03 (Gnumeric: Untrusted search path)

    James Vega reported an untrusted search path vulnerability in the     GObject Python interpreter wrapper in Gnumeric.
  Impact :

    A local attacker could entice a user to run Gnumeric from a directory     containing a specially crafted python module, resulting in the     execution of arbitrary code with the privileges of the user running     Gnumeric.
  Workaround :

    Do not run 'gnumeric' from untrusted working directories.

- Fri Jan 30 2009 Huzaifa Sidhpurwala <huzaifas at     redhat.com> 1:1.8.2-4

    - Resolves CVE-2009-5983

    - Version Bump

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
37680	Fedora 10 : gnumeric-1.8.2-6.fc10 (2009-1289)	Nessus	Fedora Local Security Checks	medium
37244	Mandriva Linux Security Advisory : gnumeric (MDVSA-2009:043)	Nessus	Mandriva Local Security Checks	medium
36086	GLSA-200904-03 : Gnumeric: Untrusted search path	Nessus	Gentoo Local Security Checks	medium
35596	Fedora 9 : gnumeric-1.8.2-4.fc9 (2009-1295)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2009-0318

high

Tenable Plugins

medium

medium

medium

medium