FreeBSD : emacs -- run-python vulnerability (66657bd5-ac92-11dd-b541-001f3b19d541)

NASLDB: FreeBSD : emacs -- run-python vulnerability (66657bd5-ac92-11dd-b541-001f3b19d541)

General

ID: 34732
Name: FreeBSD : emacs — run-python vulnerability (66657bd5-ac92-11dd-b541-001f3b19d541)

Summary: Checks for updated package in pkg_info output

Credits: Tenable Network Security, Inc.

Classification

Risk: –

CVSS: –
CVSS Base Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS Temporal Vector: –

Port: 0
Family: FreeBSD Local Security Checks
Type: Local

Description

Emacs developers report :

The Emacs command `run-python’ launches an interactive Python
interpreter. After the Python process starts up, Emacs automatically
sends it the line :

import emacs

which normally imports a script named emacs.py which is distributed
with Emacs. This script, which is typically located in a
write-protected installation directory with other Emacs program files,
defines various functions to help the Python process communicate with
Emacs.

The vulnerability arises because Python, by default, prepends ‘’ to
the module search path, so modules are looked for in the current
directory. If the current directory is world-writable, an attacker may
insert malicious code by adding a fake Python module named emacs.py
into that directory.

Exploiting

Exploit Available: –
Exploitability Ease: –

Sources

CVE: CVE-2008-3949
OSVDB: –
Bugtraq: –
scipID: –

Timeline

Vulnerability Disclosure: 2008/09/05
Patch Release: 2008/11/07
Plugin Release: 2008/11/11

Plugin

Version: 1.11
Filename: freebsd_pkg_66657bd5ac9211ddb541001f3b19d541.nasl
Filesize: 4819 bytes
MD5 Hash: fb8233c9bf144064231777342acc0ab9

Identification: Host/local_checks_enabled
Require Keys: Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info
Dependencies: "ssh_get_info.nasl"

Latest Plugins

Latest Plugins

scip AG