Debian DSA 159-1: Moderate Risk Python Insecure Temp Files Exploit

debian

August 28, 2002

A flaw in Python was discovered with an insecure use of a temporary file inos._execvpe from os.py

Topics Covered

security advisory debian insecure files local threat temporary files python code execution risk

Summary

Zack Weinberg discovered an insecure use of a temporary file in
os._execvpe from os.py. It uses a predictable name which could lead
execution of arbitrary code.

This problem has been fixed in several versions of Python: For the
current stable distribution (woody) it has been fixed in version
1.5.2-23.1 of Python 1.5, in version 2.1.3-3.1 of Python 2.1 and in
version 2.2.1-4.1 of Python 2.2. For the old stable distribution
(potato) this has been fixed in version 1.5.2-10potato12 for Python
1.5. For the unstable distribution (sid) this has been fixed in
version 1.5.2-24 of Python 1.5, in version 2.1.3-6a of Python 2.1 and
in version 2.2.1-8 of Python 2.2. Python 2.3 is not affected by this
problem.

We recommend that you upgrade your Python packages immediately.

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
...