Python 'Lib/CGIHTTPServer.py' Script Directory Traversal Vulnerability
BID:64615
Info
Python 'Lib/CGIHTTPServer.py' Script Directory Traversal Vulnerability
| Bugtraq ID: | 64615 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 29 2013 12:00AM |
| Updated: | Oct 29 2013 12:00AM |
| Credit: | Unknown |
| Vulnerable: |
Python Software Foundation Python 3.2 Python Software Foundation Python 3.1 Python Software Foundation Python 2.7 |
| Not Vulnerable: |
Python Software Foundation Python 3.3.3 Python Software Foundation Python 2.7.6 |
Discussion
Python 'Lib/CGIHTTPServer.py' Script Directory Traversal Vulnerability
Python is prone to a directory-traversal vulnerability.
A remote attacker could exploit the vulnerability using directory-traversal characters ('../') to execute arbitrary scripts in the directory in which the server is running.
Python is prone to a directory-traversal vulnerability.
A remote attacker could exploit the vulnerability using directory-traversal characters ('../') to execute arbitrary scripts in the directory in which the server is running.
Exploit / POC
Python 'Lib/CGIHTTPServer.py' Script Directory Traversal Vulnerability
An attacker can use readily available tools to exploit this issue.
An attacker can use readily available tools to exploit this issue.
Solution / Fix
Python 'Lib/CGIHTTPServer.py' Script Directory Traversal Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Python 'Lib/CGIHTTPServer.py' Script Directory Traversal Vulnerability
References:
References:
- Directory traversal attack for CGIHTTPRequestHandler (python)
- Python 3.3.3 release candidate 1 (python)
- Python Homepage (Python Software Foundation)