distutils : file "bdist_rpm.py" allows Shell injection in "name"
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Python |
Invalid
|
Unknown
|
|||
| python2.7 (Ubuntu) |
Incomplete
|
Undecided
|
Unassigned | ||
Bug Description
File :
/usr/lib/
Line 358 :
This line in the code uses the depreached os.popen command, should be replaced with subprocess.Popen() :
out = os.popen(q_cmd)
Exploit demo :
============
1) Download the setup.py script wich i attached
2) Create a test folder an put the setup.py script in this folder
3) cd to the test folder
4) python setup.py bdist_rpm
5) A xmessage window pops up as a proof of concept
ProblemType: Bug
DistroRelease: Ubuntu 15.10
Package: libpython2.7-stdlib 2.7.10-4ubuntu1
ProcVersionSign
Uname: Linux 4.2.0-17-generic x86_64
NonfreeKernelMo
ApportVersion: 2.19.1-0ubuntu4
Architecture: amd64
CurrentDesktop: Unity
Date: Sun Nov 8 13:47:34 2015
InstallationDate: Installed on 2015-10-22 (16 days ago)
InstallationMedia: Ubuntu 15.10 "Wily Werewolf" - Release amd64 (20151021)
SourcePackage: python2.7
UpgradeStatus: No upgrade log present (probably fresh install)
| Bernd Dietzel (l-ubuntuone1104) wrote | #1 |
| summary: |
- distutils : filebdist_rpm.py allows Shell injection in "name" + distutils : file "bdist_rpm.py" allows Shell injection in "name" |
| information type: | Public → Public Security |
| description: | updated |
| Tyler Hicks (tyhicks) wrote | #2 |
| Changed in python2.7 (Ubuntu): | |
| status: | New → Incomplete |
| Bernd Dietzel (l-ubuntuone1104) wrote | #3 |
| Bernd Dietzel (l-ubuntuone1104) wrote | #4 |
| Changed in python: | |
| status: | Unknown → New |
| Changed in python: | |
| status: | New → Invalid |
Hi Bernd - Thanks for the bug report! While I think that this is something that should be fixed upstream, I don't feel like it is a security issue.
By running `python setup.py ...`, you're already trusting that setup.py is not malicious. It could execute xmessage directly.
Do you know if there are any other ways to trigger the problematic popen() call that doesn't require executing the Python script that has the malicious program name?
Have you reported this issue to upstream Python?