CVE-2014-1934

Local symlink vulnerability in eyeD3 (python-eyed3) <= 7.0.3 and <= 0.6.18 allows arbitrary file modification via temporary file manipulation

• CVSS 3.3
• CWE-59 Improper Link Resolution Before File Access ('Link Following')
• Input Validation and Sanitization
• Local

tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file.

CVE

CVE-2014-1934

CWE

CWE-59 Improper Link Resolution Before File Access ('Link Following')

CVSS base score

3.3

Published

2014-05-08

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Local

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update eyeD3 (python-eyed3) to version 7.0.4 or higher.

import os
import tempfile

def write_to_temp_file(data):
    # VULNERABLE: This code is susceptible to path traversal
    temp_file_path = os.path.join(tempfile.gettempdir(), 'tempfile.txt')
    with open(temp_file_path, 'w') as temp_file:
        temp_file.write(data)

    final_path = 'desired_output_file.txt'
    os.rename(temp_file_path, final_path)

write_to_temp_file("This is some data.")

import os
import tempfile

def write_to_temp_file(data):
    # SECURE: This version prevents path traversal
    with tempfile.NamedTemporaryFile(delete=False) as temp_file:
        temp_file.write(data.encode('utf-8'))
        temp_file_path = temp_file.name

    final_path = 'desired_output_file.txt'
    os.rename(temp_file_path, final_path)

write_to_temp_file("This is some data.")

@misc{vaitp:cve20141934,
  title        = {{Local symlink vulnerability in eyeD3 (python-eyed3) <= 7.0.3 and <= 0.6.18 allows arbitrary file modification via temporary file manipulation}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2014},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2014-1934},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2014-1934/}}
}