Python SimpleXMLRPCServer library module security bypass
| python-simplexmlrpcserver-bypass (19217) |  High Risk |
Description:
Python could allow a remote attacker to bypass security restrictions, caused by a vulnerability in the SimpleXMLRPCServer library module. The SimpleXMLRPCServer library module allows users access to internals of the registered object without proper protection. If the register_instance method is used to register an object without a _dispatch method, a remote attacker could use this to view or modify sensitive information, and possibly execute arbitrary code on the system.
Note: Reportedly, the im_func.func_globals.update can also be used to exploit this vulnerability.
Platforms Affected:
- Canonical, Ubuntu 4.10
- Debian, Debian Linux 3.0
- Gentoo, Linux
- MandrakeSoft, Mandrake Linux 10.0 AMD64
- MandrakeSoft, Mandrake Linux 10.0
- MandrakeSoft, Mandrake Linux 10.1 X86_64
- MandrakeSoft, Mandrake Linux 10.1
- MandrakeSoft, Mandrake Linux 9.2 AMD64
- MandrakeSoft, Mandrake Linux 9.2
- MandrakeSoft, Mandrake Linux Corporate Server 2.1 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 2.1
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- Python Software Foundation, Python 2.2
- Python Software Foundation, Python 2.3 prior to 2.3.5
- Python Software Foundation, Python 2.4
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 4 AS
- Turbolinux, Turbolinux 10 Desktop
- Turbolinux, Turbolinux 10 F...
- Turbolinux, Turbolinux 10 Server
- Turbolinux, Turbolinux 8 Server
- Turbolinux, Turbolinux 8 Workstation
- Turbolinux, Turbolinux Home
- Turbolinux, Turbolinux Appliance Server 1.0 Hosting Ed
- Turbolinux, Turbolinux Appliance Server 1.0 Workgroup Ed
Remedy:
Apply the appropriate patch for your system, as listed in Python Security Advisory PSF-2005-001. See References.
For Ubuntu Linux:
Apply the appropriate patch for your system, as listed below. Refer to USN-73-1 February 03, 2005 for more information. See References.
python2.2: 2.2.3-10ubuntu0.1 or later
python2.3: 2.3.4-2ubuntu0.1 or later
For Debian GNU/Linux 3.0(woody):
Upgrade to the latest version of python (2.2.1-4.7 or later), as listed in DSA-666-1. See References.
For Red Hat Linux:
Refer to RHSA-2005:108-05 or RHSA-2005:109-04 for patch, upgrade, or suggested workaround information. See References.
For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 2005-02-09 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Bypass Security
References:
- CIAC Information Bulletin P-121, Python XML-RPC Server Vulnerability at http://www.ciac.org/ciac/bulletins/p-121.shtml.
- Python Security Advisory PSF-2005-001 , SimpleXMLRPCServer.py at http://archives.neohapsis.com/archives/bugtraq/2005-01/0395.html.
- BID-12437: Python SimpleXMLRPCServer Library Module Unauthorized Access Vulnerability
- CVE-2005-0089: The SimpleXMLRPCServer library module in Python 2.2, 2.3 before 2.3.5, and 2.4, when used by XML-RPC servers that use the register_instance method to register an object without a _dispatch method, allows remote attackers to read or modify globals of the associated module, and possibly execute arbitrary code, via dotted attributes.
- DSA-666: python2.2 -- design flaw
- GLSA-200502-09: Python: Arbitrary code execution through SimpleXMLRPCServer
- MDKSA-2005:035: Updated python packages fix vulnerability
- RHSA-2005-108: python security update
- RHSA-2005-109: python security update
- SA14128: Python SimpleXMLRPCServer Library Module Vulnerability
- SECTRACK ID: 1013083: Python SimpleXMLRPCServer May Let Remote Users Access Internal Data or Execute Arbitrary Code
- SUSE-SR:2005:005: SUSE Security Summary Report
Reported:
Feb 04, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net