SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Python Vendors:   Python.org
Python SimpleXMLRPCServer May Let Remote Users Access Internal Data or Execute Arbitrary Code
SecurityTracker Alert ID:  1013083
SecurityTracker URL:  http://securitytracker.com/id/1013083
CVE Reference:   CVE-2005-0089   (Links to External Site)
Date:  Feb 3 2005
Impact:   Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.2 all versions, 2.3 prior to 2.3.5, 2.4
Description:   A vulnerability was reported in Python in the SimpleXMLRPCServer library module. A remote user can access internal module data, potentially executing arbitrary code.

The vendor reported that Python XML-RPC servers that use the register_instance() method to register an object without a _dispatch() method are affected. A remote user may be able to view or modify globals of the module or other modules that contain the registered instance's class(es).

Situations where the registered object is a module present a serious risk. If, for example, the registered module imports the os module, then a remote user can invoke the os.system() function to execute arbitrary operating system commands.

The Python development team discovered this flaw.

Impact:   A remote user may be able to gain read and write access to internal module data and functions, potentially executing arbitrary code.
Solution:   The vendor plans to issue fixed versions (2.3.5, 2.4.1). Version 2.3.5 is to be released within a few days from their announcement and version 2.4.1 is to be released later in February 2005.

The vendor has issued patches for Python 2.2, 2.3, and 2.4, available at:

http://python.org/security/PSF-2005-001/patch-2.2.txt (Python 2.2)

http://python.org/security/PSF-2005-001/patch.txt (Python 2.3, 2.4)

The vendor notes that the patches disable recursive traversal, which may adversely affect some XML-RPC applications that use the feature.

Vendor URL:  www.python.org/security/PSF-2005-001/PSF-2005-001.txt (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Feb 11 2005 (Mandrake Issues Fix) Python SimpleXMLRPCServer May Let Remote Users Access Internal Data or Execute Arbitrary Code
Mandrake has released a fix.
Feb 16 2005 (Red Hat Issues Fix) Python SimpleXMLRPCServer May Let Remote Users Access Internal Data or Execute Arbitrary Code
Red Hat has released a fix.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC