/usr/bin/eyeD3 depends on PATH to find python, crashes with ImportError

[jimav]

/usr/bin/eyeD3 is a python script which starts with

     #!/usr/bin/env python

but instead should hard-code the path where Ubuntu installed the version of python which has eyeD3's companion libraries:

     #!/usr/bin/python

Depending on PATH leads to disaster if multiple python executables are installed and anything other than the system default is first in PATH. The problem is that eyeD3 depends on its own app-specific libraries, and each python installation uses its own separate library directories. So if the "wrong" python interpreter is used, the expected libraries will not be found. This causes the eye3D program to crash with

    ImportError: No module named eyeD3

In particular, if a Libre Office test build is installed and /opt/libreoffice*/program is before /usr/bin in PATH (as it must be to use conveniently), then "eyeD3" crashes with an import error because libreoffice comes with its own python installation.

This is also a security risk because a script named "python" will be executed without the user's knowledge if "." is in PATH before /usr/bin

ProblemType: Bug
DistroRelease: Ubuntu 13.04
Package: eyed3 0.6.18-1
ProcVersionSignature: Ubuntu 3.8.0-29.42-generic 3.8.13.5
Uname: Linux 3.8.0-29-generic x86_64
ApportVersion: 2.9.2-0ubuntu8.3
Architecture: amd64
Date: Tue Sep 3 16:47:18 2013
InstallationDate: Installed on 2013-08-06 (28 days ago)
InstallationMedia: Ubuntu 13.04 "Raring Ringtail" - Release amd64 (20130424)
MarkForUpload: True
PackageArchitecture: all
SourcePackage: eyed3
UpgradeStatus: No upgrade log present (probably fresh install)

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privilege boundaries nor directly cause loss of data/privacy. Please feel free to report any other bugs you may find.

[jimav (james-avera)]

Ok.
P.S. I marked it as security sensitive because it involves an unexpected
search of $PATH to find an executable.

On 09/13/2013 01:26 PM, Marc Deslauriers wrote:
> Thanks for taking the time to report this bug and helping to make Ubuntu
> better. We appreciate the difficulties you are facing, but this appears
> to be a "regular" (non-security) bug. I have unmarked it as a security
> issue since this bug does not show evidence of allowing attackers to
> cross privilege boundaries nor directly cause loss of data/privacy.
> Please feel free to report any other bugs you may find.
>
> ** Information type changed from Private Security to Public
>

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Brian Murray (brian-murray)]

eyed3 (0.7.9-1) unstable; urgency=low

  * New upstream version (Closes: #815123)
  * Drop patch reproducible-build (manpage is no longer generated)
  * Drop patch CVE-2014-1934, issue is fixed upstream
  * Add patch launch-script-with-system-python.patch to always start
    eyed3 script with system python (Closes: #720473)

  * Upload sponsored by Petter Reinholdtsen.

 -- Gaetano Guerriero <email address hidden> Mon, 12 Sep 2016 06:25:26 +0000