[ GLSA 200505-14 ] Cheetah: Untrusted module search path

[GLSA]

Gentoo Linux Security Advisory

Title: Cheetah: Untrusted module search path (GLSA 200505-14)
Severity: normal
Exploitable: local
Date: May 19, 2005
Updated: May 17, 2006
Bug(s): #92926
ID: 200505-14

Synopsis

Cheetah contains a vulnerability in the module importing code that can allow a local user to gain escalated privileges.

Background

Cheetah is a Python powered template engine and code generator.

Affected Packages

Package: dev-python/cheetah
Vulnerable: < 0.9.17_rc1
Unaffected: >= 0.9.17_rc1
Architectures: All supported architectures


Description

Brian Bird discovered that Cheetah searches for modules in the world-writable /tmp directory.

Impact

A malicious local user could place a module containing arbitrary code in /tmp, which when imported would run with escalated privileges.

Workaround

There are no known workarounds at this time.

Resolution

All Cheetah users should upgrade to the latest version: