Jinja2 'jinja2.bccache.FileSystemBytecodeCache' Insecure File Permissions Vulnerability

Bugtraq ID:	64759
Class:	Design Error
CVE:	CVE-2014-1402
Remote:	No
Local:	Yes
Published:	Jan 09 2014 12:00AM
Updated:	Apr 13 2015 10:10PM
Credit:	Jakub Wilk
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Redhat Software Collections for RHEL 0 Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux Desktop Optional 6 Python Software Foundation Jinja2 2.7.1 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Gentoo Linux CentOS CentOS 6
Not Vulnerable:	Python Software Foundation Jinja2 2.7.2

Jinja2 'jinja2.bccache.FileSystemBytecodeCache' Insecure File Permissions Vulnerability

Jinja2 is prone to an insecure file-permission vulnerability.

A local attacker can exploit this issue to execute arbitrary code in the context of another user. This may aid in further attacks.

Jinja2 'jinja2.bccache.FileSystemBytecodeCache' Insecure File Permissions Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Mandriva Business Server 1 X86 64

• Mandriva python-jinja2-2.5.5-8.1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/

Jinja2 'jinja2.bccache.FileSystemBytecodeCache' Insecure File Permissions Vulnerability

References:

• Jinja2 Homepage (Python Software Foundation)
  
• jinja2.bccache.FileSystemBytecodeCache: insecure default directory (Jakub Wilk)
  
• Security Advisory Moderate: python33-python-jinja2 and python27-python-jinja2 se (Red Hat)