Full Disclosure mailing list archives
Google App Enging SDK Code Execution Vulnerability (CVE 2011-1364)
From: Adi Sharabani <adish () il ibm com>
Date: Tue, 11 Oct 2011 22:51:07 +0200
We recently identified an interesting code execution vulnerability in the Google App Engine SDK for Python. By combining a CSRF vulnerability in the administration web UI, with some other unique vulnerabilities we found in the Google python libraries, a remote hacker could gain remote code execution privileges on victim's machine. This vulnerability affects all operation systems running Google App Engine SDK for python (i.e. Windows, Mac OS, etc.). Full advisory can be found at: http://blog.watchfire.com/wfblog/2011/10/google-app-engine-cve-2011-1364.html -Adish Adi Sharabani Security Strategist, Master Inventor, IBM _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Google App Enging SDK Code Execution Vulnerability (CVE 2011-1364) Adi Sharabani (Oct 12)