Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:PYTHON-DIA-RCE |
|---|---|
Severity |
Minor |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Dia 'PySys_SetArgv' Remote Command Execution |
Release Date |
2016/09/08 |
Update Number |
2776 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: Dia 'PySys_SetArgv' Remote Command Execution
This signature detects a remote command-execution vulnerability against one of Python plugins Dia. An attacker could exploit this issue by enticing an unsuspecting victim to execute the vulnerable application in a directory containing a malicious Python file.
Extended Description
Untrusted search path vulnerability in the Python plugin in Dia 0.96.1, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
Affected Products
- Dia dia 0.96.1
References
- CVE: CVE-2008-5984