PT-2005-2609 · Cheetah · Cheetah

Published 2005-05-17 · Updated 2022-05-01 · CVE-2005-1632

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cheetah versions 0.9.15 through 0.9.16

Description The issue allows local users to execute arbitrary code via a malicious module in the /tmp directory. This is possible because the software searches the /tmp directory for modules before using the paths in the PYTHONPATH variable.

Recommendations For versions 0.9.15 and 0.9.16, consider restricting access to the /tmp directory to prevent malicious modules from being executed. As a temporary workaround, avoid using the PYTHONPATH variable until a patch is available. Restrict the execution of arbitrary code by disabling the module search in the /tmp directory until the issue is resolved.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2005-1632

GHSA-VXF2-7RC3-PXMX

Affected Products

Cheetah

References · 10

• https://osv.dev/vulnerability/CVE-2005-1632 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-1632 · Vendor Advisory
• http://secunia.com/advisories/15386 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1632 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-1632 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vxf2-7rc3-pxmx · Vendor Advisory
• http://sourceforge.net/mailarchive/forum.php?thread_id=7070332&forum_id=1542 · Patch
• https://github.com/cheetahtemplate/cheetah · Note
• https://web.archive.org/web/20050430021153/http://sourceforge.net/mailarchive/forum.php?thread_id=7070332&forum_id=1542 · Note
• http://osvdb.org/16622 · Note