[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 09 Dec 2013 09:50:37 +1000
From: Grant Murphy <gmurphy@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Issue with PYTHON_EGG_CACHE
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Not sure if this warrants a CVE -
Python .egg files can be loaded dynamically as dependencies. In order
to process native DSO in .egg distributions the content of the file is
unpacked. By default Python unpacks the files to $HOME/.python-eggs
however this 'egg cache' directory can be overwritten by setting the
environment variable PYTHON_EGG_CACHE.
It is common practice to set this to a world writeable directory such
as /tmp in the instances where the user the process is executing as
does not have a home directory (e.g. httpd). Unfortunately the
extraction is done in such a way that the extraction path for the DSO
is deterministic. As such it exposes a TOCTOU attack vector where a
user my pre-emptively injecting a specially crafted DSO to achieve
arbitrary code execution and potentially privilege escalation.
The current version of setuptools attempts to mitigate this threat by
a number of additional integrity checks in conjunction with issuing a
warning if the extract directory is group or world writeable.
This fix was introduced in version 0.6.46 of Python setuptools
(https://pypi.python.org/pypi/setuptools#id48).
The discovery of this issue can be attributed to Dhiru Kohlia and myself.
- - Grant.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iF4EAREIAAYFAlKlBckACgkQcd9RAn5tszrDUQD9E7ZzCeLu2ojoSL/vtonbhCoX
WASCa5LxDjIRlv2Fq7IA/jXb+ppEOdj8KBnnWbm4XRl8vbocKW5w2sNOvpZu9MhV
=Sifa
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
