cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - python-suds: Insecure temporary directory use when initializing file-based URL cache (CVE-2013-2217)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - python-suds: Insecure temporary directory use when initializing file-based URL cache (CVE-2013-2217)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - python-suds: Insecure temporary directory use when initializing file-based URL cache (CVE-2013-2217)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b31f7029-817c-4c1f-b7d3-252de5283393 advisory.

  - cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and     possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in     /tmp/suds/. (CVE-2013-2217)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for python-suds-jurko fixes the following issues :

  - CVE-2013-2217: A temporary directory was used in an     insecure fashion when initializing file-based URL cache.
    (boo#827568)

Python SUDS was updated to create a create random cache tempdir to avoid other local user access (bnc#827568) (CVE-2013-2217)

Ralph Loader discovered that Suds incorrectly handled temporary files.
A local attacker could possibly use this issue to overwrite arbitrary files. In the default installation of Ubuntu, this should be prevented by the Yama link restrictions.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199676	RHEL 7 : python-suds (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	low
199637	RHEL 6 : python-suds (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	low
199607	RHEL 5 : python-suds (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	low
174308	FreeBSD : py-suds -- vulnerable to symlink attacks (b31f7029-817c-4c1f-b7d3-252de5283393)	Nessus	FreeBSD Local Security Checks	high
94032	openSUSE Security Update : python-suds-jurko (openSUSE-2016-1178)	Nessus	SuSE Local Security Checks	low
75090	openSUSE Security Update : python-suds (openSUSE-SU-2013:1208-1)	Nessus	SuSE Local Security Checks	low
70608	Ubuntu 12.04 LTS / 12.10 / 13.04 : suds vulnerability (USN-2008-1)	Nessus	Ubuntu Local Security Checks	low

Detections

Analytics

CVE-2013-2217

low

Tenable Plugins

low

low

low

high

low

low

low