CVE-2012-5379 Privilege escalation in n/a
Local attackers can gain privileges via DLL hijacking if ActivePython is installed in the root directory and PATH is modified by an administrator.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2012-5379?
CVE-2012-5379 is a high-severity vulnerability in n/a, published on 11 Oct 2012. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Untrusted search path vulnerability in the installation functionality in ActivePython 3.2.2.3, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\Python27 or C:\Python27\Scripts directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview. NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the ActivePython installation
Which versions are affected by CVE-2012-5379?
It affects 1 product.
Products include Activestate Activepython.
How do I fix CVE-2012-5379?
No fix has been published for CVE-2012-5379 yet. Limit exposure of the affected software until one is available.
Is CVE-2012-5379 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-5379 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-v592-hhw6-w7x7.