PT-2020-9842 · Unknown · Pyinstaller

David Ha + 5 · Published 2020-01-14 · Updated 2020-10-09 · CVE-2019-16784

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PyInstaller versions prior to 3.6

Description A local privilege escalation issue is present in Windows software frozen by PyInstaller in "onefile" mode, when launched by a privileged user with a "TempPath" resolving to a world writable directory, such as C:WindowsTemp. This can occur when the software is launched as a service or scheduled task using a system account. The software must be restarted after the attacker launches the exploit program for exploitation to be possible.

Recommendations For PyInstaller versions prior to 3.6, upgrade to PyInstaller version 3.6 and rebuild the software to resolve the issue. As a temporary workaround, consider avoiding the use of "onefile" mode for Windows software frozen by PyInstaller until a patch is applied. Restrict access to world writable directories, such as C:WindowsTemp, to minimize the risk of exploitation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-250

CWE-732

Related Identifiers

CVE-2019-16784

GHSA-7FCJ-PQ9J-WH2R

PYSEC-2020-175

Affected Products

Pyinstaller

References · 9

• https://github.com/pyinstaller/pyinstaller/security/advisories/GHSA-7fcj-pq9j-wh2r · Patch
• https://osv.dev/vulnerability/CVE-2019-16784 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16784 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-175 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7fcj-pq9j-wh2r · Vendor Advisory
• https://github.com/pyinstaller/pyinstaller · Note
• https://github.com/pyinstaller/pyinstaller/commit/be948cf0954707671aa499da17b10c86b6fa5e5c · Note
• https://github.com/pyinstaller/pyinstaller/commit/42a67148b3bdf9211fda8499fdc5b63acdd7e6cc · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/pyinstaller/PYSEC-2020-175.yaml · Note