exploit the possibilities

Mandriva Linux Security Advisory 2013-227

Mandriva Linux Security Advisory 2013-227
Posted Sep 9, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-227 - A vulnerability has been discovered and corrected in easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product. The updated python-setuptools packages has been upgraded to the 0.9.8 version and the python-virtualenv packages has been upgraded to the 1.10.1 version which is not vulnerable to this issue.

tags | advisory, web, arbitrary, python
systems | linux, mandriva
advisories | CVE-2013-1633
MD5 | 520c1d270c4f885b8eb147d9079fb02a

Mandriva Linux Security Advisory 2013-227

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:227
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : python-setuptools
Date : September 9, 2013
Affected: Business Server 1.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

A vulnerability has been discovered and corrected in
python-setuptools/python-virtualenv:

easy_install in setuptools before 0.7 uses HTTP to retrieve packages
from the PyPI repository, and does not perform integrity checks on
package contents, which allows man-in-the-middle attackers to execute
arbitrary code via a crafted response to the default use of the product
(CVE-2013-1633).

The updated python-setuptools packages has been upgraded to the 0.9.8
version and the python-virtualenv packages has been upgraded to the
1.10.1 version which is not vulnerable to this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1633
_______________________________________________________________________

Updated Packages:

Mandriva Enterprise Server 5:
e1cb29da242ab6e8e1159d3944222d8d mes5/i586/python-pkg-resources-0.9.8-0.1mdvmes5.2.noarch.rpm
7ab6f335508a6492632c6fc03a5ecdcc mes5/i586/python-setuptools-0.9.8-0.1mdvmes5.2.noarch.rpm
258487e101cef7b253f735efb0510cbf mes5/i586/python-virtualenv-1.10.1-0.1mdvmes5.2.noarch.rpm
e666fcfc1c64f270a4e13d023e270a9d mes5/SRPMS/python-setuptools-0.9.8-0.1mdvmes5.2.src.rpm
7041c005b2bdb503d949b07c37388cb6 mes5/SRPMS/python-virtualenv-1.10.1-0.1mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
1c2fd8142ac903fdad66a6f4f2feed0f mes5/x86_64/python-pkg-resources-0.9.8-0.1mdvmes5.2.noarch.rpm
f1e480dd21ff6c5c9fbed415e7a7bdf4 mes5/x86_64/python-setuptools-0.9.8-0.1mdvmes5.2.noarch.rpm
f309ac0531583675a1db38117fc25d53 mes5/x86_64/python-virtualenv-1.10.1-0.1mdvmes5.2.noarch.rpm
e666fcfc1c64f270a4e13d023e270a9d mes5/SRPMS/python-setuptools-0.9.8-0.1mdvmes5.2.src.rpm
7041c005b2bdb503d949b07c37388cb6 mes5/SRPMS/python-virtualenv-1.10.1-0.1mdvmes5.2.src.rpm

Mandriva Business Server 1/X86_64:
65a932783bd31f9b08c589e8d2759b1a mbs1/x86_64/python-pkg-resources-0.9.8-1.1.mbs1.noarch.rpm
db9923d3d8f0a3091a359f241376b96a mbs1/x86_64/python-setuptools-0.9.8-1.1.mbs1.noarch.rpm
2c2de1f8c488e47229c9814723e1162a mbs1/x86_64/python-virtualenv-1.10.1-1.mbs1.noarch.rpm
61b5bca18ac1dc48e4af0961f45f3672 mbs1/SRPMS/python-setuptools-0.9.8-1.1.mbs1.src.rpm
03fbed23bdef2a9c667fc8e585a030aa mbs1/SRPMS/python-virtualenv-1.10.1-1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFSLZCjmqjQ0CJFipgRAnzIAJsGW/9oKmcMG7w5rYgh2WviBPNIEACgt+eZ
DL5xgKWU4weNpgvabeCT6d4=
=0G1r
-----END PGP SIGNATURE-----


Login or Register to add favorites

File Archive:

January 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    4 Files
  • 2
    Jan 2nd
    3 Files
  • 3
    Jan 3rd
    3 Files
  • 4
    Jan 4th
    33 Files
  • 5
    Jan 5th
    31 Files
  • 6
    Jan 6th
    21 Files
  • 7
    Jan 7th
    15 Files
  • 8
    Jan 8th
    19 Files
  • 9
    Jan 9th
    1 Files
  • 10
    Jan 10th
    1 Files
  • 11
    Jan 11th
    33 Files
  • 12
    Jan 12th
    19 Files
  • 13
    Jan 13th
    27 Files
  • 14
    Jan 14th
    8 Files
  • 15
    Jan 15th
    16 Files
  • 16
    Jan 16th
    1 Files
  • 17
    Jan 17th
    2 Files
  • 18
    Jan 18th
    20 Files
  • 19
    Jan 19th
    32 Files
  • 20
    Jan 20th
    15 Files
  • 21
    Jan 21st
    10 Files
  • 22
    Jan 22nd
    16 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close