Re: CVE-2016-4000

--===============3876934405420534152==
Content-Type: multipart/alternative; boundary="0000000000000c7785058bd61b14"

--0000000000000c7785058bd61b14
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Without knowing anything about your project let me throw out there.. people
can write their own py scripts and run them on your server?

Is that sandboxed at all? specific packages only? (shoudl be jailed hard
somehow...)

Because pythin has many packages for say..
- executing binaries (running external programs); wouldn't take more than
an exec/system to rm -rf / :)
- read or write over system config files
- pull in any old system shared library and invoke calls to it (ctypes etc)

So, without knowing details, no one can provide advice; but 'run python
scripts' basicly means 'wide open' in my book :)

On Fri, Jun 21, 2019 at 8:33 AM Samuel Schober <[email protected]> wrote:

> Hello Adam,
>
> thank you for quick response.
>
> Basicly we have a java application which provides as a part of it a pytho=
n
> code editor so you can execute your own python scripts.
>
> I think if you only can inject python code the issue should be not a
> critical issue, because the user has the possibility to write the code
> directly in the script.
> But if there could be executed any code to attack the server, it would be
> much worse.
>
> In the new version of our application we use the 2.7.1 version, but one o=
f
> our customers uses a 2 years old version of our application and there is
> still the 2.5.3 version of jython in use.
> To upgrade to 2.7.1 would be my last choice, because the application grew
> quite big and sadly there would be very many changes required in the old
> code.
>
> Best regards,
> Samuel
>
> *Gesendet:* Freitag, 21. Juni 2019 um 13:26 Uhr
> *Von:* "Adam Burke" <[email protected]>
> *An:* "Samuel Schober" <[email protected]>, "
> [email protected]" <[email protected]>
> *Betreff:* Re: [Jython-users] CVE-2016-4000
> Going from the bug report, I didn=E2=80=99t work on it, and a core dev co=
uld
> correct me, but it=E2=80=99s specifically about deserializing Python obje=
cts.
>
> https://hg.python.org/jython/rev/d06e29d100c0
>
> It would depend on whether your app had an exposed endpoint that accepted
> Python objects. All the usual caveats about eg web form data hygiene appl=
y.
>
> Without knowing your exact organizational or technical constraint, I woul=
d
> mention that security bugs can be excellent sticks for pushing through
> needed, but delayed, upgrades to current versions of infrastructure and
> libraries, like upgrading to Jython 2.7.1. Priorities can suddenly realig=
n.
>
> Cheers
> Adam
>
> =E5=9C=A8 2019=E5=B9=B46=E6=9C=8821=E6=97=A5=EF=BC=8C=E4=B8=8B=E5=8D=889:=
19=EF=BC=8CAdam Burke <[email protected]> =E5=86=99=E9=81=93=EF=BC=9A
>
>
> Going from the bug report, it=E2=80=99s specifically about deserializing =
Python
> objects.
>
> https://hg.python.org/jython/rev/d06e29d100c0
>
> It would depend on whether your app had an exposed endpoint that accepted
> Python objects. All the usual caveats about eg web form data hygiene appl=
y.
>
> Without knowing your exact organizational or technical constraint, I woul=
d
> say that security bugs can be excellent sticks for pushing through needed=
,
> but delayed, upgrades to current versions of infrastructure and libraries=
,
> like upgrading to Jython 2.7.1. Priorities can suddenly realign.
>
> Cheers
> Adam
>
> =E5=9C=A8 2019=E5=B9=B46=E6=9C=8821=E6=97=A5=EF=BC=8C=E4=B8=8B=E5=8D=888:=
57=EF=BC=8CSamuel Schober <[email protected]> =E5=86=99=E9=81=93=EF=BC=9A
>
>
> Hello,
>
>
>
> I am using the jython package for an project and have a question about an
> issue you had.
>
>
>
> The used version is 2.5.3 and unfortunally it can not be updated to 2.7.1=
.
> Now I found the following issue:
>
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2016-4000
>
>
>
> It notices that jython allows attackers to execute arbitrary code and I
> wanted to ask what kind of code could be executed?
>
> Is it only python code which could be executed or is it possible to
> execute any kind of binary code?
>
> And is it possible to have influence on the server outside of the
> application or does it just affect my application?
>
>
>
> I hope you can help me with that question.
>
>
>
> Best regards,
>
> Samuel Schober
>
>
>
> _______________________________________________
> Jython-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/jython-users
>
> _______________________________________________
> Jython-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/jython-users
>

--0000000000000c7785058bd61b14
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Without knowing anything about your project let me throw o=
ut there.. people can write their own py scripts and run them on your serve=
r?<div><br></div><div>Is that sandboxed at all? specific packages only? (sh=
oudl be jailed hard somehow...)</div><div><br></div><div>Because pythin has=
 many packages for say..</div><div>- executing binaries (running external p=
rograms); wouldn&#39;t take more than an exec/system to rm -rf / :)</div><d=
iv>- read or write over system config files</div><div>- pull in any old sys=
tem shared library and invoke calls to it (ctypes etc)</div><div><br></div>=
<div>So, without knowing details, no one can provide advice; but &#39;run p=
ython scripts&#39; basicly means &#39;wide open&#39; in my book :)</div></d=
iv><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On =
Fri, Jun 21, 2019 at 8:33 AM Samuel Schober &lt;<a href=3D"mailto:sami.scho=
[email protected]">[email protected]</a>&gt; wrote:<br></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex"><div><div style=3D"font-family:Verdana;fon=
t-size:12px"><div>Hello Adam,</div>

<div>=C2=A0</div>

<div>thank you for quick response.</div>

<div>=C2=A0</div>

<div>Basicly we have a java application which provides as a part of it a py=
thon code editor so you can execute your own python scripts.</div>

<div>=C2=A0</div>

<div>I think if you only can inject python code the issue should be not a c=
ritical=C2=A0issue, because the user has the possibility=C2=A0to write the =
code directly in the script.</div>

<div>But if there could be executed any code to attack the server, it would=
 be much worse.</div>

<div>=C2=A0</div>

<div>
<div>In the new version of our application we use the 2.7.1 version, but on=
e of our customers uses a 2 years old version of our application and there =
is still the 2.5.3 version of jython in use.</div>
To upgrade to 2.7.1 would be my last choice, because the application grew q=
uite big and sadly there would be very many changes required in the old cod=
e.</div>

<div>=C2=A0</div>

<div>Best regards,</div>

<div>Samuel</div>

<div>=C2=A0
<div name=3D"quote" style=3D"margin:10px 5px 5px 10px;padding:10px 0px 10px=
 10px;border-left:2px solid rgb(195,217,229)">
<div style=3D"margin:0px 0px 10px"><b>Gesendet:</b>=C2=A0Freitag, 21. Juni =
2019 um 13:26 Uhr<br>
<b>Von:</b>=C2=A0&quot;Adam Burke&quot; &lt;<a href=3D"mailto:adamburkemail=
@gmail.com" target=3D"_blank">[email protected]</a>&gt;<br>
<b>An:</b>=C2=A0&quot;Samuel Schober&quot; &lt;<a href=3D"mailto:sami.schob=
[email protected]" target=3D"_blank">[email protected]</a>&gt;, &quot;<a href=3D"=
mailto:[email protected]" target=3D"_blank">jython-users@l=
ists.sourceforge.net</a>&quot; &lt;<a href=3D"mailto:[email protected]=
rceforge.net" target=3D"_blank">[email protected]</a>&gt;<=
br>
<b>Betreff:</b>=C2=A0Re: [Jython-users] CVE-2016-4000</div>

<div name=3D"quoted-content">
<div><span>Going from the bug report, I didn=E2=80=99t work on it, and a co=
re dev could correct me, but it=E2=80=99s specifically about deserializing =
Python objects.</span>

<div>=C2=A0</div>

<div><a href=3D"https://hg.python.org/jython/rev/d06e29d100c0" target=3D"_b=
lank"><font color=3D"#000000">https://hg.python.org/jython/rev/d06e29d100c0=
</font></a></div>

<div>=C2=A0</div>

<div><span>It would depend on whether your app had an exposed endpoint that=
 accepted Python objects. All the usual caveats about eg web form data hygi=
ene apply.</span></div>

<div>=C2=A0</div>

<div><span>Without knowing your exact organizational or technical constrain=
t, I would mention</span><span>=C2=A0that security bugs can be excellent st=
icks for pushing through needed, but delayed, upgrades to current versions =
of infrastructure and libraries, like upgrading to Jython 2.7.1. Priorities=
 can suddenly realign.</span></div>

<div>=C2=A0</div>
Cheers

<div id=3D"gmail-m_-9136918033219895576AppleMailSignature">Adam</div>

<div><br>
=E5=9C=A8 2019=E5=B9=B46=E6=9C=8821=E6=97=A5=EF=BC=8C=E4=B8=8B=E5=8D=889:19=
=EF=BC=8CAdam Burke &lt;<a href=3D"mailto:[email protected]" target=
=3D"_blank">[email protected]</a>&gt; =E5=86=99=E9=81=93=EF=BC=9A<br>
=C2=A0</div>

<blockquote>
<div>Going from the bug report, it=E2=80=99s specifically about deserializi=
ng Python objects.
<div>=C2=A0</div>

<div><a href=3D"https://hg.python.org/jython/rev/d06e29d100c0" target=3D"_b=
lank">https://hg.python.org/jython/rev/d06e29d100c0</a></div>

<div>=C2=A0</div>

<div>It would depend on whether your app had an exposed endpoint that accep=
ted Python objects. All the usual caveats about eg web form data hygiene ap=
ply.</div>

<div>=C2=A0</div>

<div>Without knowing your exact organizational or technical constraint, I w=
ould say that security bugs can be excellent sticks for pushing through nee=
ded, but delayed, upgrades to current versions of infrastructure and librar=
ies, like upgrading to Jython 2.7.1. Priorities can suddenly realign.</div>

<div>=C2=A0</div>

<div>Cheers
<div id=3D"gmail-m_-9136918033219895576AppleMailSignature">Adam</div>

<div><br>
=E5=9C=A8 2019=E5=B9=B46=E6=9C=8821=E6=97=A5=EF=BC=8C=E4=B8=8B=E5=8D=888:57=
=EF=BC=8CSamuel Schober &lt;<a href=3D"mailto:[email protected]" target=
=3D"_blank">[email protected]</a>&gt; =E5=86=99=E9=81=93=EF=BC=9A<br>
=C2=A0</div>

<blockquote>
<div>
<div style=3D"font-family:Verdana;font-size:12px">
<div>
<p><span style=3D"font-size:11pt"><span style=3D"font-family:Calibri,sans-s=
erif">Hello,</span></span></p>

<p>=C2=A0</p>

<p><span style=3D"font-size:11pt"><span style=3D"font-family:Calibri,sans-s=
erif">I am using the jython package for an project and have a question abou=
t an issue you had.</span></span></p>

<p>=C2=A0</p>

<p><span style=3D"font-size:11pt"><span style=3D"font-family:Calibri,sans-s=
erif">The used version is 2.5.3 and unfortunally it can not be updated to 2=
.7.1. Now I found the following issue:=C2=A0</span></span></p>

<p><span style=3D"font-size:11pt"><span style=3D"font-family:Calibri,sans-s=
erif"><a href=3D"http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2016-4=
000" style=3D"color:rgb(5,99,193);text-decoration:underline" target=3D"_bla=
nk">http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2016-4000</a></span=
></span></p>

<p>=C2=A0</p>

<p><span style=3D"font-size:11pt"><span style=3D"font-family:Calibri,sans-s=
erif">It notices that jython allows attackers to execute arbitrary code and=
 I wanted to ask what kind of code could be executed?</span></span></p>

<p><span style=3D"font-size:11pt"><span style=3D"font-family:Calibri,sans-s=
erif">Is it only python code which could be executed or is it possible to e=
xecute any kind of binary code? </span></span></p>

<p><span style=3D"font-size:11pt"><span style=3D"font-family:Calibri,sans-s=
erif">And is it possible=C2=A0to have influence on the server outside of th=
e application or does it just affect my application?</span></span></p>

<p>=C2=A0</p>

<p><span style=3D"font-size:11pt"><span style=3D"font-family:Calibri,sans-s=
erif">I hope you can help me with that question.</span></span></p>

<p>=C2=A0</p>

<p><span style=3D"font-size:11pt"><span style=3D"font-family:Calibri,sans-s=
erif">Best regards,</span></span></p>

<p><span style=3D"font-size:11pt"><span style=3D"font-family:Calibri,sans-s=
erif">Samuel Schober</span></span></p>
</div>
</div>
</div>
</blockquote>

<blockquote>
<div>=C2=A0</div>
</blockquote>

<blockquote>
<div><span>_______________________________________________</span><br>
<span>Jython-users mailing list</span><br>
<span><a href=3D"mailto:[email protected]" target=3D"_blan=
k">[email protected]</a></span><br>
<span><a href=3D"https://lists.sourceforge.net/lists/listinfo/jython-users"=
 target=3D"_blank">https://lists.sourceforge.net/lists/listinfo/jython-user=
s</a></span></div>
</blockquote>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div></div></div>

_______________________________________________<br>
Jython-users mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">Jyt=
[email protected]</a><br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/jython-users" rel=
=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/lists/listi=
nfo/jython-users</a><br>
</blockquote></div>

--0000000000000c7785058bd61b14--


--===============3876934405420534152==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============3876934405420534152==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Jython-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/jython-users

--===============3876934405420534152==--