CVE-2014-1624: Race Condition in python-xdg Allows Arbitrary File Overwrite
Summary
CVE-2014-1624: Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned locati... Affects pyxdg versions >= 0.25, < 0.26. Fixed in 0.26. How to fix ↓
Also tracked for
- pyxdg · Debian:11
The same CVE-2014-1624 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-xdg is a Python library that provides implementation of various Freedesktop.org standards. It is commonly used to handle base directories and user directories in a cross-platform manner. The library allows applications to locate and access directories such as configuration, data, and cache directories. However, a vulnerability in python-xdg version 0.25 exposes a race condition that can be exploited by local users to overwrite arbitrary files on the system.
Vulnerability Detail
The vulnerability (CVE-2014-1624) arises from a race condition in the xdg.BaseDirectory.get_runtime_dir function of python-xdg 0.25. By pre-creating a file named '/tmp/pyxdg-runtime-dir-fallback-victim' that points to a location owned by the victim, an attacker can replace it with a symlink to an attacker-controlled location when the get_runtime_dir function is called. This allows the attacker to overwrite arbitrary files on the system, potentially leading to privilege escalation or unauthorized access to sensitive information.
How To Fix
Minimum fixed version
0.26
This is the first release that contains the fix.
pip install --upgrade "pyxdg==0.26"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in python-xdg version 0.25 allows local users to overwrite arbitrary files on the system. It is recommended to upgrade to version 0.26 or later to fix this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for pyxdg →
FAQ
python-xdg is a Python library that provides implementation of various Freedesktop.org standards for handling base directories and user directories in a cross-platform manner.
This vulnerability allows local users to overwrite arbitrary files on the system, potentially leading to privilege escalation or unauthorized access to sensitive information.
The vulnerability affects python-xdg version 0.25.
Yes, the vulnerability has been fixed in python-xdg version 0.26.
No specific workarounds have been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for pyxdg.
