NumPy 'mktemp' Insecure Temporary File Creation Vulnerability

Bugtraq ID:	65440
Class:	Design Error
CVE:	CVE-2014-1859
Remote:	No
Local:	Yes
Published:	Feb 05 2014 12:00AM
Updated:	Apr 13 2015 10:08PM
Credit:	Jakub Wilk
Vulnerable:	Numpy developers NumPy 1.7.1
Not Vulnerable:

NumPy 'mktemp' Insecure Temporary File Creation Vulnerability

NumPy is prone to a vulnerability because it creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in obtaining sensitive information. Other attacks may also be possible.

NumPy 'mktemp' Insecure Temporary File Creation Vulnerability

An attacker can use readily available commands to exploit this issue.

NumPy 'mktemp' Insecure Temporary File Creation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

NumPy 'mktemp' Insecure Temporary File Creation Vulnerability

References:

• python-pil: CVE-2014-1932 CVE-2014-1933 (Debian)
  
• F2PY Homepage (F2PY )
  
• Re: CVE request: f2py insecure temporary file use (SecLists.Org)
  
• remove insecure mktemp usage #4262 (charris)