Python keyring '_relocate_file()' Function Insecure File Permissions Vulnerability

Bugtraq ID:	56578
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Nov 16 2012 12:00AM
Updated:	Nov 16 2012 12:00AM
Credit:	Jamie Strandboge
Vulnerable:	Python Software Foundation keyring 0.9.1 Python Software Foundation keyring 0.8.1 Python Software Foundation keyring 0.9
Not Vulnerable:	Python Software Foundation keyring 0.10

Python keyring '_relocate_file()' Function Insecure File Permissions Vulnerability

The Python keyring is prone to an insecure file-permission vulnerability.

An attacker can exploit this issue to obtain sensitive information. This may aid in further attacks.

Python keyring '_relocate_file()' Function Insecure File Permissions Vulnerability

Attackers can use readily available tools and standard commands to exploit this issue.

Python keyring '_relocate_file()' Function Insecure File Permissions Vulnerability

Solution:
Updates are available. Please see the references for details.

Python keyring '_relocate_file()' Function Insecure File Permissions Vulnerability

References:

• ~/crypted_pass.cfg created with insecure permissions (Ubuntu)
  
• COMMIT (Jason R. Coombs)
  
• Issue: Rset go-rwx on keyring_pass.cfg (Daniel Holth)
  
• Python keyring HomePage (Python Software Foundation)