CVE-2014-3429: Code Injection

IPython Notebook 0.12 through 1.x before 1.2.0 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.

— GitHub

It was reported [1],[2] that IPython's Notebook server suffered from a flaw where it did not verify the origin of websocket requests. An attacker with knowledge of the IPython kernel ID could run arbitrary code on a user's machine with the privileges of the user running the IPython Notebook server, if the client visited a crafted malicious page. This was corrected upstream [3] in the 2.0.0 release [4]. Further details on the flaw were also published [5].

The report that indicates versions 0.12 through to the fixed 2.0.0 release are vulnerable to this flaw. As a result, the version of IPython shipped with EPEL5 (0.8.4) is not vulnerable to this issue as the vulnerable websocket code is not present.

[1] http://openwall.com/lists/oss-security/2014/07/15/2 [2] http://permalink.gmane.org/gmane.comp.python.ipython.devel/13198 [3] https://github.com/ipython/ipython/pull/4845 [4] http://ipython.org/ipython-doc/stable/whatsnew/github-stats-2.0.html [5] http://lambdaops.com/cross-origin-websocket-hijacking-of-ipython

— Red Hat