Gregory Trubetskoy mod_python Imported Module Access Vulnerability
BID:4656
Info
Gregory Trubetskoy mod_python Imported Module Access Vulnerability
| Bugtraq ID: | 4656 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 10 2002 12:00AM |
| Updated: | Apr 10 2002 12:00AM |
| Credit: | Discovered by Allan Saddi <[email protected]>. |
| Vulnerable: |
Gregory Trubetskoy mod_python 2.7.7 Gregory Trubetskoy mod_python 2.7.6 Gregory Trubetskoy mod_python 2.7.5 Gregory Trubetskoy mod_python 2.7.4 Gregory Trubetskoy mod_python 2.7.3 Gregory Trubetskoy mod_python 2.7.2 Gregory Trubetskoy mod_python 2.7.1 Gregory Trubetskoy mod_python 2.7 |
| Not Vulnerable: |
Gregory Trubetskoy mod_python 2.7.8 |
Exploit / POC
Gregory Trubetskoy mod_python Imported Module Access Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Gregory Trubetskoy mod_python Imported Module Access Vulnerability
Solution:
Javier Quinteros <[email protected]> has suggested that including the following line at the top of sensitive modules will prevent direct access:
__auth__ = {}
An updated version is available:
Gregory Trubetskoy mod_python 2.7
Gregory Trubetskoy mod_python 2.7.1
Gregory Trubetskoy mod_python 2.7.2
Gregory Trubetskoy mod_python 2.7.3
Gregory Trubetskoy mod_python 2.7.4
Gregory Trubetskoy mod_python 2.7.5
Gregory Trubetskoy mod_python 2.7.6
Gregory Trubetskoy mod_python 2.7.7
Solution:
Javier Quinteros <[email protected]> has suggested that including the following line at the top of sensitive modules will prevent direct access:
__auth__ = {}
An updated version is available:
Gregory Trubetskoy mod_python 2.7
-
Gregory Trubetskoy mod_python-2.7.8.tgz
http://www.modpython.org/dist/mod_python-2.7.8.tgz
Gregory Trubetskoy mod_python 2.7.1
-
Gregory Trubetskoy mod_python-2.7.8.tgz
http://www.modpython.org/dist/mod_python-2.7.8.tgz
Gregory Trubetskoy mod_python 2.7.2
-
Gregory Trubetskoy mod_python-2.7.8.tgz
http://www.modpython.org/dist/mod_python-2.7.8.tgz
Gregory Trubetskoy mod_python 2.7.3
-
Gregory Trubetskoy mod_python-2.7.8.tgz
http://www.modpython.org/dist/mod_python-2.7.8.tgz
Gregory Trubetskoy mod_python 2.7.4
-
Gregory Trubetskoy mod_python-2.7.8.tgz
http://www.modpython.org/dist/mod_python-2.7.8.tgz
Gregory Trubetskoy mod_python 2.7.5
-
Conectiva mod_python-2.7.8-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/mod_python-2.7.8-1U70_1cl .i386.rpm -
Conectiva mod_python-2.7.8-1U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/mod_python-2.7.8-1U8_1cl.i3 86.rpm -
Gregory Trubetskoy mod_python-2.7.8.tgz
http://www.modpython.org/dist/mod_python-2.7.8.tgz
Gregory Trubetskoy mod_python 2.7.6
-
Gregory Trubetskoy mod_python-2.7.8.tgz
http://www.modpython.org/dist/mod_python-2.7.8.tgz -
Red Hat mod_python-2.7.8-1.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/mod_python-2.7.8-1.i386.rpm -
Red Hat mod_python-2.7.8-1.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/mod_python-2.7.8-1.ia64.rpm
Gregory Trubetskoy mod_python 2.7.7
-
Gregory Trubetskoy mod_python-2.7.8.tgz
http://www.modpython.org/dist/mod_python-2.7.8.tgz
References
Gregory Trubetskoy mod_python Imported Module Access Vulnerability
References:
References:
- [mod_python] publisher security concerns (Allan Saddi [email protected] )
- [mod_python] publisher security concerns (Gregory (Grisha) Trubetskoy [email protected] )
- Mod_python Homepage (Gregory Trubetskoy)