Full Disclosure mailing list archives
[ GLSA 200502-09 ] Python: Arbitrary code execution through SimpleXMLRPCServer
From: Thierry Carrez <koon () gentoo org>
Date: Tue, 08 Feb 2005 22:32:37 +0100
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200502-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Python: Arbitrary code execution through SimpleXMLRPCServer Date: February 08, 2005 Bugs: #80592 ID: 200502-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Python-based XML-RPC servers may be vulnerable to remote execution of arbitrary code. Background ========== Python is an interpreted, interactive, object-oriented, cross-platform programming language. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-lang/python <= 2.3.4 >= 2.3.4-r1 *>= 2.3.3-r2 *>= 2.2.3-r6 Description =========== Graham Dumpleton discovered that XML-RPC servers making use of the SimpleXMLRPCServer library that use the register_instance() method to register an object without a _dispatch() method are vulnerable to a flaw allowing to read or modify globals of the associated module. Impact ====== A remote attacker may be able to exploit the flaw in such XML-RPC servers to execute arbitrary code on the server host with the rights of the XML-RPC server. Workaround ========== Python users that don't make use of any SimpleXMLRPCServer-based XML-RPC servers, or making use of servers using only the register_function() method are not affected. Resolution ========== All Python users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose dev-lang/python References ========== [ 1 ] CAN-2005-0089 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0089 [ 2 ] Python PSF-2005-001 http://www.python.org/security/PSF-2005-001/ Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200502-09.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security () gentoo org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2005 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.0
Attachment:
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- [ GLSA 200502-09 ] Python: Arbitrary code execution through SimpleXMLRPCServer Thierry Carrez (Feb 08)