Vulnerability Name:

CVE-2013-2217 (CCN-85506)

Assigned:2013-07-02
Published:2013-07-02
Updated:2019-04-22
Summary:cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.
CVSS v3 Severity:5.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:1.2 Low (CVSS v2 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:N)
0.9 Low (Temporal CVSS v2 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:N/E:U/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
3.3 Low (CCN CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P)
2.7 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P/E:U/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-59
Vulnerability Consequences:File Manipulation
References:Source: MITRE
Type: CNA
CVE-2013-2217

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2013:1208

Source: MLIST
Type: UNKNOWN
[oss-security] 20130628 Re: CVE Request -- python-suds: Insecure temporary directory use when initializing file-based URL cache

Source: CCN
Type: OSVDB ID: 94682
python-suds Cached File Symlink Arbitrary Query Manipulation

Source: CCN
Type: BID-60827
python-suds Insecure Temporary File Creation Vulnerability

Source: UBUNTU
Type: UNKNOWN
USN-2008-1

Source: CCN
Type: Red Hat Bugzilla Bug 978696
CVE-2013-2217 python-suds: Insecure temporary directory use when initializing file-based URL cache

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=978696

Source: XF
Type: UNKNOWN
pythonsuds-cve20132217-symlink(85506)

Source: CCN
Type: python-suds Web Site
python-suds

Vulnerable Configuration:Configuration 1:
  • cpe:/a:jeff_ortel:suds:0.4:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:opensuse:opensuse:12.2:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20132217
    V
    		CVE-2013-2217
    2022-06-30
    oval:org.opensuse.security:def:113305
    P
    		python36-suds-jurko-0.6-6.9 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:113224
    P
    		python-suds-jurko-0.6-4.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:113304
    P
    		python36-suds-community-0.8.5-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:55272
    P
    		Security update for webkit2gtk3 (Important)
    2021-11-23
    oval:org.opensuse.security:def:106715
    P
    		python36-suds-jurko-0.6-6.9 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:106642
    P
    		python-suds-jurko-0.6-4.1 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:55955
    P
    		Security update for libqt5-qtbase (Important)
    2021-09-30
    oval:org.opensuse.security:def:55132
    P
    		Security update for MozillaFirefox (Critical)
    2020-12-21
    oval:org.opensuse.security:def:56514
    P
    		Security update for kernel-firmware (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55510
    P
    		Security update for spice (Important)
    2020-12-01
    oval:org.opensuse.security:def:56240
    P
    		Security update for opus (Important)
    2020-12-01
    oval:org.opensuse.security:def:55110
    P
    		ft2demos on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56552
    P
    		Security update for libofx (Important)
    2020-12-01
    oval:org.opensuse.security:def:55683
    P
    		Security update for libpng12 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56348
    P
    		Security update for libXfont (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56633
    P
    		Security update for libraw (Low)
    2020-12-01
    oval:org.opensuse.security:def:55789
    P
    		Security update for rsync (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56440
    P
    		Security update for libzypp (Important)
    2020-12-01
    oval:org.opensuse.security:def:55109
    P
    		freerdp on GA media (Moderate)
    2020-12-01
    oval:org.mitre.oval:def:19222
    P
    		USN-2008-1 -- suds vulnerability
    2014-07-07
    oval:com.ubuntu.precise:def:20132217000
    V
    		CVE-2013-2217 on Ubuntu 12.04 LTS (precise) - medium.
    2013-09-23
    BACK
    jeff_ortel suds 0.4
    opensuse opensuse 12.2
    opensuse opensuse 12.3
    redhat enterprise linux 5
    redhat enterprise linux 6.0