gentoo-overlay/metadata/glsa/glsa-200911-04.xml

65 lines
2 KiB
XML

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="200911-04">
<title>dstat: Untrusted search path</title>
<synopsis>
An untrusted search path vulnerability in the dstat might result in the
execution of arbitrary code.
</synopsis>
<product type="ebuild">dstat</product>
<announced>2009-11-25</announced>
<revised count="01">2009-11-25</revised>
<bug>293497</bug>
<access>local</access>
<affected>
<package name="sys-apps/dstat" auto="yes" arch="*">
<unaffected range="ge">0.6.9-r1</unaffected>
<vulnerable range="lt">0.6.9-r1</vulnerable>
</package>
</affected>
<background>
<p>
dstat is a versatile system resource monitor written in Python.
</p>
</background>
<description>
<p>
Robert Buchholz of the Gentoo Security Team reported that dstat
includes the current working directory and subdirectories in the Python
module search path (sys.path) before calling "import".
</p>
</description>
<impact type="normal">
<p>
A local attacker could entice a user to run "dstat" from a directory
containing a specially crafted Python module, resulting in the
execution of arbitrary code with the privileges of the user running the
application.
</p>
</impact>
<workaround>
<p>
Do not run "dstat" from untrusted working directories.
</p>
</workaround>
<resolution>
<p>
All dstat users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose "&gt;=sys-apps/dstat-0.6.9-r1"</code>
</resolution>
<references>
<uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3894">CVE-2009-3894</uri>
</references>
<metadata tag="requester" timestamp="2009-11-17T12:30:20Z">
rbu
</metadata>
<metadata tag="submitter" timestamp="2009-11-17T12:35:21Z">
rbu
</metadata>
<metadata tag="bugReady" timestamp="2009-11-25T13:40:09Z">
rbu
</metadata>
</glsa>