Python SimpleXMLRPCServer module Security Vulnerability

Source: Internet
Author: User


Information provision:

Provide hotline: 51cto.editor@gmail.com

Vulnerability category:

Design Error

Attack type:

Embed malicious code

Release date:

Updated on:

Affected Systems:

Ubuntu 4.10
Python/python 2.3
Python/python 2.2

Security system:

None

Vulnerability Reporter:

Martin Pitt martin.pitt@canonical.com)

Vulnerability description:

CVE (CAN) ID: CAN-2005-0089
Python is a powerful open-source scripting language.
Python SimpleXMLRPCServer module has a defect. Remote attackers can exploit this vulnerability to access and change the function.
The Python XML-RPC Service uses the register_instance () method to register an object and does not use the _ dispatch () method, allowing remote users to access or change the function using the im _ * And func _ * attributes. If the registered object is an OS module, attackers can call the OS. system () function to execute arbitrary commands.

Test method:

None

Solution:

Vendor patch:
Ubuntu
------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.2/python2.2_2.2.3-10ubuntu0.1.diff.gz
Size/MD5: 1927781 2df9c99747532348619bbb8d8d5f3996
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.2/python2.2_2.2.3-10ubuntu0.1.dsc
Size/MD5: 1184 3e1c5d029c99987852bad718712dcf76
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.2/python2.2_2.2.3.orig.tar.gz
Size/MD5: 6711816 c23fbe6a0cdf800734f5813b9f7cb1d0
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3_2.3.4-2ubuntu0.1.diff.gz
Size/MD5: 2284380 04304bcdf030e24976fa4f846b754aa8
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3_2.3.4-2ubuntu0.1.dsc
Size/MD5: 1141 28c897b1a2c44ee9eb72cc30177f8697
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3_2.3.4.orig.tar.gz
Size/MD5: 8502596 d68a6a490c04b2c8f664ba4f2192e2fb
Architecture independent packages:
Http://security.ubuntu.com/ubuntu/pool/universe/p/python2.2/idle-python2.2_2.2.3-10ubuntu0.1_all.deb
Size/MD5: 116018 b4ab3787a4c6b4025a9ae70393990b45
Http://security.ubuntu.com/ubuntu/pool/universe/p/python2.3/idle-python2.3_2.3.4-2ubuntu0.1_all.deb
Size/MD5: 228350 07375ecb2762227776cd700429d8531c
Http://security.ubuntu.com/ubuntu/pool/universe/p/python2.2/python2.2-doc_2.2.3-10ubuntu0.1_all.deb
Size/MD5: 2268242 a572cf6409ca4a82721952ae7d36529d
Http://security.ubuntu.com/ubuntu/pool/universe/p/python2.2/python2.2-examples_2.2.3-10ubuntu0.1_all.deb
Size/MD5: 479006 cdf96d86449bdbd72ef25e5830a9a8fe
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3-doc_2.3.4-2ubuntu0.1_all.deb
Size/MD5: 2816894 91930347a10bb529d3cba16312457d76
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3-examples_2.3.4-2ubuntu0.1_all.deb
Size/MD5: 507732 2daf5ccaec4f6b967223b09b15f85197
Amd64 architecture (Athlon64, Opteron, EM64T Xeon)
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.2/python2.2-dev_2.2.3-10ubuntu0.1_amd64.deb
Size/MD5: 1402344 a1d36ff39d0fb0cf2a05b22175f3083f
Http://security.ubuntu.com/ubuntu/pool/universe/p/python2.2/python2.2-gdbm_2.2.3-10ubuntu0.1_amd64.deb
Size/MD5: 20138 e771840c7881423e226d0fb37a2e1a1e
Http://security.ubuntu.com/ubuntu/pool/universe/p/python2.2/python2.2-mpz_2.2.3-10ubuntu0.1_amd64.deb
Size/MD5: 24932 a71d0c4e6301b330b62edc7425300ae
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.2/python2.2-tk_2.2.3-10ubuntu0.1_amd64.deb
Size/MD5: 96092 606bcccac218c73b3f86658cb4ba4750
Http://security.ubuntu.com/ubuntu/pool/universe/p/python2.2/python2.2-xmlbase_2.2.3-10ubuntu0.1_amd64.deb
Size/MD5: 54902 a030a68171c6fc6591a9e8af1ed1c31b
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.2/python2.2_2.2.3-10ubuntu0.1_amd64.deb
Size/MD5: 2240692 59cb63acc72ee9b6b93f786555f6343f
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3-dev_2.3.4-2ubuntu0.1_amd64.deb
Size/MD5: 1747592 a9c0dd251682fb7101ebfcad03d1d114
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3-gdbm_2.3.4-2ubuntu0.1_amd64.deb
Size/MD5: 22300 5cc5444cf4c6361e7f2bb7970a53dad2
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3-mpz_2.3.4-2ubuntu0.1_amd64.deb
Size/MD5: 27138 f362a0c22d0ebeb4f82910ce8fad2206
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3-tk_2.3.4-2ubuntu0.1_amd64.deb
Size/MD5: 104686 ce82ad1e4225e88a9d442e86e3df1cbd
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3_2.3.4-2ubuntu0.1_amd64.deb
Size/MD5: 2868960 2eb165d9c2654606c26cf2f8e195b638
I386 architecture (x86 compatible Intel/AMD)
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.2/python2.2-dev_2.2.3-10ubuntu0.1_i386.deb
Size/MD5: 1272072 875cdbb06f99e8a47e3c101e15663c8a
Http://security.ubuntu.com/ubuntu/pool/universe/p/python2.2/python2.2-gdbm_2.2.3-10ubuntu0.1_i386.deb
Size/MD5: 19798 d77efa2115ebe5865ea364851469a829
Http://security.ubuntu.com/ubuntu/pool/universe/p/python2.2/python2.2-mpz_2.2.3-10ubuntu0.1_i386.deb
Size/MD5: 23686 45e1ed9fd53a647d917537c10c7a46d6
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.2/python2.2-tk_2.2.3-10ubuntu0.1_i386.deb
Size/MD5: 93364 389380de54da2d08c7b04c1aa4c95677
Http://security.ubuntu.com/ubuntu/pool/universe/p/python2.2/python2.2-xmlbase_2.2.3-10ubuntu0.1_i386.deb
Size/MD5: 53162 90aaed4f73b488ada5cd06986d226614
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.2/python2.2_2.2.3-10ubuntu0.1_i386.deb
Size/MD5: 2114526 47c6ae1fece9dc560b1e8936e79df43e
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3-dev_2.3.4-2ubuntu0.1_i386.deb
Size/MD5: 1601264 7abd99ff94b75c7afd6c1588215293de
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3-gdbm_2.3.4-2ubuntu0.1_i386.deb
Size/MD5: 21950 9b9dde52eabbc8814c1e3afa2704473f
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3-mpz_2.3.4-2ubuntu0.1_i386.deb
Size/MD5: 25828 e784462eff29ce1e01bfe752868abd27
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3-tk_2.3.4-2ubuntu0.1_i386.deb
Size/MD5: 102082 dcdfa6a516d8d304f61d545004ddd966
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3_2.3.4-2ubuntu0.1_i386.deb
Size/MD5: 2709818 3cb0d2298cd5f16cc788a605030cb443
Powerpc architecture (Apple Macintosh G3/G4/G5)
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.2/python2.2-dev_2.2.3-10ubuntu0.1_powerpc.deb
Size/MD5: 1503152 running 6f400ee60f9742b126b0e1b3a7632
Http://security.ubuntu.com/ubuntu/pool/universe/p/python2.2/python2.2-gdbm_2.2.3-10ubuntu0.1_powerpc.deb
Size/MD5: 21666 6ee9aba13aeeaa94241a8c3374845cf1
Http://security.ubuntu.com/ubuntu/pool/universe/p/python2.2/python2.2-mpz_2.2.3-10ubuntu0.1_powerpc.deb
Size/MD5: 26042 6379c3913926b334540a7242375d0941
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.2/python2.2-tk_2.2.3-10ubuntu0.1_powerpc.deb
Size/MD5: 96722 cb91d46072de61a5ada927172132ffe9
Http://security.ubuntu.com/ubuntu/pool/universe/p/python2.2/python2.2-xmlbase_2.2.3-10ubuntu0.1_powerpc.deb
Size/MD5: 55926 8cc515a6cf422176e742308f084d3f19
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.2/python2.2_2.2.3-10ubuntu0.1_powerpc.deb
Size/MD5: 2358186 d741cf48639a380c1a2b0e403d5ed8d6
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3-dev_2.3.4-2ubuntu0.1_powerpc.deb
Size/MD5: 1863678 57357eb08927011b1cd7d1_ff95bdf5
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3-gdbm_2.3.4-2ubuntu0.1_powerpc.deb
Size/MD5: 23732 b5c6ce94233cd2ec0766f2719f398cc8
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3-mpz_2.3.4-2ubuntu0.1_powerpc.deb
Size/MD5: 28194 d177c4e8a8f4a939978720e52a70f46b
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3-tk_2.3.4-2ubuntu0.1_powerpc.deb
Size/MD5: 105318 344134e35b32ee6943a77e4e11dd4d05
Http://security.ubuntu.com/ubuntu/pool/main/p/python2.3/python2.3_2.3.4-2ubuntu0.1_powerpc.deb
Size/MD5: 3024388 852ffcf5cfd7fcf2f1f65121f58dced9

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.