CVE-2012-5379

Untrusted search path vulnerability in ActivePython 3.2.2.3 during installation

• CVSS 7.3
• CWE-426: Untrusted Search Path
• Configuration Issues
• Remote

Untrusted search path vulnerability in the installation functionality in ActivePython 3.2.2.3, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\Python27 or C:\Python27\Scripts directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview. NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the ActivePython installation

CVE

CVE-2012-5379

CWE

CWE-426: Untrusted Search Path

CVSS base score

7.3

Published

2012-10-11

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Build/Package/Merge

Code defect classification

Packaging Issues

Category

Configuration Issues

Subcategory

Dynamic Link Library (DLL) Loading Issues

Accessibility scope

Remote

Impact

Privilege Escalation

Fixed by upgrading

Yes

Solution

Update to ActivePython version 3.2.2.4 or higher

import os
import ctypes

def dll_load():
    
    dll_name = 'wlbsctrl.dll'
    path = r'C:\Python27\Scripts'

    try:
        dll_path = os.path.join(path, dll_name)
        ctypes.WinDLL(dll_path)
        print(f"Successfully loaded {dll_name} from {path}")
    except Exception as e:
        print(f"Failed to load {dll_name}: {e}")

dll_load()

import os
import ctypes

def dll_load():
    trusted_path = r'C:\Windows\System32'
    dll_name = 'wlbsctrl.dll'
    dll_path = os.path.join(trusted_path, dll_name)

    if not os.path.exists(dll_path):
        print(f"{dll_name} not found in the trusted path: {trusted_path}")
        return

    try:
        ctypes.WinDLL(dll_path)
        print(f"Successfully loaded {dll_name} from {trusted_path}")
    except Exception as e:
        print(f"Failed to load {dll_name}: {e}")

dll_load()

@misc{vaitp:cve20125379,
  title        = {{Untrusted search path vulnerability in ActivePython 3.2.2.3 during installation}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2012},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2012-5379},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2012-5379/}}
}