Executable installers are vulnerable^WEVIL (case 22): python.org's executable installers allow arbitrary (remote) code execution

Posted by Stefan Kanthak on Jan 15

Hi @ll,

the executable installers python-3.5.1-webinstall.exe and
python-3.5.1.exe available on
<https://www.python.org/downloads/windows/> load and execute
multiple DLLs from their “application directory”.

For software downloaded with a web browser the application
directory is typically the user’s “Downloads” directory: see
<https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html