Executive Summary
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2013:227 | First vendor Publication | 2013-09-09 |
| Vendor | Mandriva | Last vendor Modification | 2013-09-09 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A vulnerability has been discovered and corrected in python-setuptools/python-virtualenv: easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product (CVE-2013-1633). The updated python-setuptools packages has been upgraded to the 0.9.8 version and the python-virtualenv packages has been upgraded to the 1.10.1 version which is not vulnerable to this issue. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2013:227 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:24678 | |||
| Oval ID: | oval:org.mitre.oval:def:24678 | ||
| Title: | SUSE-SU-2014:0523-1 -- Security update for python-setuptools | ||
| Description: | ython-setuptools so far used only HTTP to retrieve packages, which could have lead to man in the middle attacks on newly installed python code. This update adjusts it to use HTTPS, guaranteeing better connection integrity. Security Issue reference: * CVE-2013-1633 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1633 > | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2014:0523-1 CVE-2013-1633 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Desktop 11 | Product(s): | python-setuptools |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-04-15 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_python-setuptools-140409.nasl - Type : ACT_GATHER_INFO |
| 2013-10-11 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201310-09.nasl - Type : ACT_GATHER_INFO |
| 2013-09-10 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-227.nasl - Type : ACT_GATHER_INFO |
| 2013-09-05 | Name : The remote Fedora host is missing a security update. File : fedora_2013-14891.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:44:00 |
|
| 2013-09-09 17:19:42 |
|
