oss-sec mailing list archives
Issue with PYTHON_EGG_CACHE
From: Grant Murphy <gmurphy () redhat com>
Date: Mon, 09 Dec 2013 09:50:37 +1000
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Not sure if this warrants a CVE - Python .egg files can be loaded dynamically as dependencies. In order to process native DSO in .egg distributions the content of the file is unpacked. By default Python unpacks the files to $HOME/.python-eggs however this 'egg cache' directory can be overwritten by setting the environment variable PYTHON_EGG_CACHE. It is common practice to set this to a world writeable directory such as /tmp in the instances where the user the process is executing as does not have a home directory (e.g. httpd). Unfortunately the extraction is done in such a way that the extraction path for the DSO is deterministic. As such it exposes a TOCTOU attack vector where a user my pre-emptively injecting a specially crafted DSO to achieve arbitrary code execution and potentially privilege escalation. The current version of setuptools attempts to mitigate this threat by a number of additional integrity checks in conjunction with issuing a warning if the extract directory is group or world writeable. This fix was introduced in version 0.6.46 of Python setuptools (https://pypi.python.org/pypi/setuptools#id48). The discovery of this issue can be attributed to Dhiru Kohlia and myself. - - Grant. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iF4EAREIAAYFAlKlBckACgkQcd9RAn5tszrDUQD9E7ZzCeLu2ojoSL/vtonbhCoX WASCa5LxDjIRlv2Fq7IA/jXb+ppEOdj8KBnnWbm4XRl8vbocKW5w2sNOvpZu9MhV =Sifa -----END PGP SIGNATURE-----
Current thread:
- Issue with PYTHON_EGG_CACHE Grant Murphy (Dec 08)
- Re: Issue with PYTHON_EGG_CACHE cve-assign (Dec 09)
- Re: Re: Issue with PYTHON_EGG_CACHE Kurt Seifried (Dec 13)
- Re: Issue with PYTHON_EGG_CACHE cve-assign (Dec 15)
- Re: Re: Issue with PYTHON_EGG_CACHE Jeremy Stanley (Dec 15)
- Re: Re: Issue with PYTHON_EGG_CACHE Kurt Seifried (Dec 15)
- Re: Re: Issue with PYTHON_EGG_CACHE Yves-Alexis Perez (Dec 16)
- Re: Re: Issue with PYTHON_EGG_CACHE Kurt Seifried (Dec 16)
- Re: Re: Issue with PYTHON_EGG_CACHE Yves-Alexis Perez (Dec 17)
- Re: Re: Issue with PYTHON_EGG_CACHE Kurt Seifried (Dec 13)
- Re: Issue with PYTHON_EGG_CACHE cve-assign (Dec 09)