cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and     possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in     /tmp/suds/. (CVE-2013-2217)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b31f7029-817c-4c1f-b7d3-252de5283393 advisory.

  - cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and     possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in     /tmp/suds/. (CVE-2013-2217)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for python-suds-jurko fixes the following issues :

  - CVE-2013-2217: A temporary directory was used in an     insecure fashion when initializing file-based URL cache.
    (boo#827568)

Python SUDS was updated to create a create random cache tempdir to avoid other local user access (bnc#827568) (CVE-2013-2217)

Ralph Loader discovered that Suds incorrectly handled temporary files.
A local attacker could possibly use this issue to overwrite arbitrary files. In the default installation of Ubuntu, this should be prevented by the Yama link restrictions.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
217854	Linux Distros Unpatched Vulnerability : CVE-2013-2217	Nessus	Misc.	low
174308	FreeBSD : py-suds -- vulnerable to symlink attacks (b31f7029-817c-4c1f-b7d3-252de5283393)	Nessus	FreeBSD Local Security Checks	high
94032	openSUSE Security Update : python-suds-jurko (openSUSE-2016-1178)	Nessus	SuSE Local Security Checks	low
75090	openSUSE Security Update : python-suds (openSUSE-SU-2013:1208-1)	Nessus	SuSE Local Security Checks	low
70608	Ubuntu 12.04 LTS / 12.10 / 13.04 : suds vulnerability (USN-2008-1)	Nessus	Ubuntu Local Security Checks	low

Detections

Analytics

CVE-2013-2217

low

Tenable Plugins

low

high

low

low

low