oss-security - pscripts tmp vuln leading to possible code exec

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 11 Sep 2014 01:12:52 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
        Assign a CVE Identifier <cve-assign@...re.org>
Subject: pscripts tmp vuln leading to possible code exec

https://pypi.python.org/pypi/pscripts
pscripts-0.1.160/pscripts/external_ip_address.py


##########################################
# Settings
#--------------
ip_cache_file = '/tmp/.current_external_ip'


def save_ip_addy(new_ip, domain):
    ip_updates = shelve.open(ip_cache_file)
    ip_updates[domain] = new_ip
    log.debug("Caching IP address: {}, under domain: {}".format(new_ip,
domain))
    ip_updates.close

def read_ip_addy(domain):
    ip_updates = shelve.open(ip_cache_file)
    if ip_updates:
        if not domain in ip_updates:
            return None
        else:
            ip = ip_updates[domain]
            log.debug("Cached IP address: {} retrieved for domain:
{}".format(ip, domain))
            return ip

			
#################################
# ENTRY POINT
def
update_ddns_server(updater_urls="/etc/external_ip_updater/urls.yaml",
update=True, manual_force_update=False):
    try:
        external_ip = get_ip()
        if external_ip == None:
            log.warn("Unable to determine external IP.  This may be
temporary or not.  Verify this warning doesn't persist.")
            return
        log.debug("External IP address {}".format(str(external_ip)))
        ddns_urls = read_yaml_update_urls(updater_urls)
        for domain, update_url in ddns_urls.items():
            log.debug("For domain: {}, the update url is:
{}".format(domain,update_url))
            prev_ext_ip = read_ip_addy(domain)
            changed = ip_addy_changed(external_ip, prev_ext_ip)
            if changed or manual_force_update or periodic_force_update():
                log.debug("IP changed or forcing update.")
                if update or manual_force_update:
                    log.info("Updating domain: {} with IP:
{}".format(domain, external_ip))
                    touch_ddns_server(update_url)
                    save_ip_addy(external_ip,domain)

Then later on:
					
def test_update_ip():
    updater_urls = "/etc/external_ip_updater/urls.yaml"
    update_ddns_server(updater_urls, force_update=True)

So it looks like you might be able to write to the cache and then do a
man in the middle attack against the updater which I'm guessing == code
exec.

-- 
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993


Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.