Python Pickle class constructor Remote Arbitrary Code Execution Vulnerability

Information provision:	Provide hotline: 51cto.editor@gmail.com
Vulnerability category:	Remote Arbitrary Code Execution Vulnerability
Attack type:	Remote attack
Release date:	2002-07-26
Updated on:	2002-07-26
Affected Systems:	Python Software Foundation Python 2.1.3 Python Software Foundation Python 2.1.2 Python Software Foundation Python 2.1.1 Python Software Foundation Python 2.1 Python Software Foundation Python 2.0.1 Python Software Foundation Python 2.0 Python Software Foundation Python 1.6.1 Python Software Foundation Python 1.6 Python Software Foundation Python 1.5.2
Security system:	Python Software Foundation Python 2.2.1 Python Software Foundation Python 2.2
Vulnerability Reporter:	Jeff Epler
Vulnerability description:	Bugtraq id: 5257 Python is an open-source, object-oriented programming language. Python provides a standard module called pickle, which can convert a Python object into a string representation. This process is called "pickling", while recovering an object from the string representation is called "unpickling ". The implementation of the pickle module lacks data check in the "unpickling" process. Remote attackers can exploit this vulnerability to execute arbitrary Python commands in the Python application process. Python can call the constructor to restore objects from the object string. The class must define attribute _ safe_for_unpickling _ as the true value. Otherwise, an exception occurs, because the class constructor is a simple call object, a Pickle can be named by any function and provide any parameters, so the build contains commands similar to "echo r00t: 0: 0 :: /:/bin/sh>/etc/passwd. The pickle class with the parameter can cause any Python command to be executed by the Python application process. The exploitation of this vulnerability is highly dependent on whether the Python application can receive "pickle" strings from external sources.
Test method:	None
Solution:	Currently, the vendor has fixed this security issue in Python 2.2 or later versions. Please download it from the vendor's homepage: Http://www.python.org/