Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2012-1206 advisory.

    [1.7.3-5]
    - fix group permissions in serve.py     Resolves: CVE-2012-0878

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Python Paste provides middleware for building and running Python web applications. The python-paste-script package includes paster, a tool for working with and running Python Paste applications.

It was discovered that paster did not drop supplementary group privileges when started by the root user. Running 'paster serve' as root to start a Python web application that will run as a non-root user and group resulted in that application running with root group privileges. This could possibly allow a remote attacker to gain access to files that should not be accessible to the application.
(CVE-2012-0878)

All paster users should upgrade to this updated package, which contains a backported patch to resolve this issue. All running paster instances configured to drop privileges must be restarted for this update to take effect.

An updated python-paste-script package that fixes one security issue is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Python Paste provides middleware for building and running Python web applications. The python-paste-script package includes paster, a tool for working with and running Python Paste applications.

It was discovered that paster did not drop supplementary group privileges when started by the root user. Running 'paster serve' as root to start a Python web application that will run as a non-root user and group resulted in that application running with root group privileges. This could possibly allow a remote attacker to gain access to files that should not be accessible to the application.
(CVE-2012-0878)

All paster users should upgrade to this updated package, which contains a backported patch to resolve this issue. All running paster instances configured to drop privileges must be restarted for this update to take effect.

This update fixes a security flaw with Paster that prevents it from properly dropping privileges when run as root.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
68604	Oracle Linux 6 : python-paste-script (ELSA-2012-1206)	Nessus	Oracle Linux Local Security Checks	medium
61694	Scientific Linux Security Update : python-paste-script on SL6.x i386/x86_64 (20120827)	Nessus	Scientific Linux Local Security Checks	medium
61689	RHEL 6 : python-paste-script (RHSA-2012:1206)	Nessus	Red Hat Local Security Checks	medium
61682	CentOS 6 : python-paste-script (CESA-2012:1206)	Nessus	CentOS Local Security Checks	medium
58686	Fedora 17 : python-paste-script-1.7.5-4.fc17 (2012-2302)	Nessus	Fedora Local Security Checks	medium
58623	Fedora 16 : python-paste-script-1.7.5-4.fc16 (2012-2418)	Nessus	Fedora Local Security Checks	medium
58622	Fedora 15 : python-paste-script-1.7.5-4.fc15 (2012-2413)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-0878

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium