when format strings attack

[Eric_Dexter]

http://www.ddj.com/184405774;jsessio...QCKHSCJUNN2JVN

I saw a warning from homeland security about this. I only comment on
the because I am trying to use os.system('comm and1 arg') and it doesn't
work but I do see examples with % that is borrowed from the c language.
Seems like if I can write a batch file that does something the same
behavior should happen in the os module..

[Gabriel Genellina]

<Er*********@ms n.comescribió en el mensaje
news:11******** **************@ q2g2000cwa.goog legroups.com...

http://www.ddj.com/184405774;jsessio...QCKHSCJUNN2JVN

I saw a warning from homeland security about this. I only comment on
the because I am trying to use os.system('comm and1 arg') and it doesn't
work but I do see examples with % that is borrowed from the c language.
Seems like if I can write a batch file that does something the same
behavior should happen in the os module..

Pure Python programs are not affected, but a review of the C implementation
should be made to see if any (variant of) printf is used without a proper
format. Anyway I doubt you could find something, because the vulnerability
is so well known for ages.

--
Gabriel Genellina

[Nick Maclaren]

In article <ma************ *************** ************@py thon.org>,
"Gabriel Genellina" <ga******@yahoo .com.arwrites:
|<Er*********@m sn.comescribió en el mensaje
|news:11******* *************** @q2g2000cwa.goo glegroups.com.. .
|>
| http://www.ddj.com/184405774;jsessio...QCKHSCJUNN2JVN
|
| I saw a warning from homeland security about this. I only comment on
| the because I am trying to use os.system('comm and1 arg') and it doesn't
| work but I do see examples with % that is borrowed from the c language.
| Seems like if I can write a batch file that does something the same
| behavior should happen in the os module..
|>
|Pure Python programs are not affected, but a review of the C implementation
|should be made to see if any (variant of) printf is used without a proper
|format. Anyway I doubt you could find something, because the vulnerability
|is so well known for ages.

Not really. There are LOTS of vulnerabilities that have been known
for ages and are still legion. The reason that this is unlikely is
that it is both easy to spot and trivial to fix.
Regards,
Nick Maclaren.

[Gabriel Genellina]

"Nick Maclaren" <nm**@cus.cam.a c.ukescribió en el mensaje
news:eo******** **@gemini.csx.c am.ac.uk...

In article <ma************ *************** ************@py thon.org>,
"Gabriel Genellina" <ga******@yahoo .com.arwrites:
|>
|Pure Python programs are not affected, but a review of the C
implementation
|should be made to see if any (variant of) printf is used without a
proper
|format. Anyway I doubt you could find something, because the
vulnerability
|is so well known for ages.

Not really. There are LOTS of vulnerabilities that have been known
for ages and are still legion. The reason that this is unlikely is
that it is both easy to spot and trivial to fix.

Yes... Anyway, unless someone actually *do* revise the code, if it's easy or
not has no importance. I think that some automated tools were used to find
problems, but I don't know if this specific vulnerability was searched.

--
Gabriel Genellina

[John Zenger]

Perhaps it is not as severe a security risk, but pure Python programs
can run into similar problems if they don't check user input for %
codes. Example:

>>k = raw_input("Try to trick me: ")

Try to trick me: How about %s this?

>>j = "User %s just entered: " + k
print j % "John"

Traceback (most recent call last):
File "<pyshell#8 >", line 1, in ?
print j % "John"
TypeError: not enough arguments for format string

On Jan 19, 10:44 am, "Gabriel Genellina" <gagsl...@yahoo .com.arwrote:

<Eric_Dex...@ms n.comescribió en el mensajenews:11* *************** ******@q2g2000c wa.googlegroups .com...

http://www.ddj.com/184405774;jsessio...QCKHSCJUNN2JVN

I saw a warning from homeland security about this. I only comment on
the because I am trying to use os.system('comm and1 arg') and it doesn't
work but I do see examples with % that is borrowed from the c language.
Seems like if I can write a batch file that does something the same
behavior should happen in the os module..Pure Python programs are not affected, but a review of the C implementation

should be made to see if any (variant of) printf is used without a proper
format. Anyway I doubt you could find something, because the vulnerability
is so well known for ages.

--
Gabriel Genellina

[Steven D'Aprano]

On Fri, 19 Jan 2007 03:51:08 -0800, Er*********@msn .com wrote:

http://www.ddj.com/184405774;jsessio...QCKHSCJUNN2JVN

I saw a warning from homeland security about this. I only comment on
the because I am trying to use os.system('comm and1 arg') and it doesn't
work

What do you mean, doesn't work? It works fine for me, precisely as
expected. What does it do for you? Crash Windows? Crash Python? Raise an
exception? Return an unexpected result?

but I do see examples with % that is borrowed from the c language.

The "When Format Strings Attack" article isn't relevant to Python. Unlike
C, Python doesn't arbitrary dump bytes from the stack into a string if you
print a string containing %s. In Python, print just prints strings, it
doesn't do any string formatting. String formatting is done by the %
operator, so print "a string containing %s" is safe.

You'd be better off looking at Python examples than C. This is what I'm
guessing you're doing:

>>command1 = 'dir'
args = '-l text.txt'
os.system('co mmand1 arg')

sh: command1: command not found
32512

os.system doesn't do name-lookups of the string you pass to it. The right
way to do this is some variation on this:

>>commandline = "%s %s" % (command1, args)
commandline

'dir -l text.txt'

>>os.system(com mandline)

-rw-rw-r-- 1 steve steve 333 Sep 24 16:51 text.txt
0

or even something like this:

os.system('dir -l %s' % 'text.txt')
Now, there is a security risk: you might set command1 yourself, and
allow the user to set args. If command1 is an external application
with a security hole, and the user provides arguments that trigger that
bug, then naturally your application will inherit whatever security
vulnerabilities the external application suffers from. No surprises there.
--
Steven.

[Gabriel Genellina]

At Friday 19/1/2007 15:43, John Zenger wrote:

>Perhaps it is not as severe a security risk, but pure Python programs
can run into similar problems if they don't check user input for %
codes. Example:

>k = raw_input("Try to trick me: ")

Try to trick me: How about %s this?

>j = "User %s just entered: " + k
print j % "John"

Traceback (most recent call last):
File "<pyshell#8 >", line 1, in ?
print j % "John"
TypeError: not enough arguments for format string

That's not a problem, it's an exception. *This* is a problem:
printf("Hello, %s")
--
Gabriel Genellina
Softlab SRL


_______________ _______________ _______________ _____
Preguntá. Respondé. Descubrí.
Todo lo que querías saber, y lo que ni imaginabas,
está en Yahoo! Respuestas (Beta).
¡Probalo ya!
http://www.yahoo.com.ar/respuestas

[Steven D'Aprano]

On Fri, 19 Jan 2007 10:43:53 -0800, John Zenger wrote:

Perhaps it is not as severe a security risk, but pure Python programs
can run into similar problems if they don't check user input for %
codes.

Please don't top-post.

A: Because it messes up the order that we read things.
Q: Why?
A: Top-posting.
Q: What is the most annoying newsgroup habit?

Example:

>>>k = raw_input("Try to trick me: ")

Try to trick me: How about %s this?

>>>j = "User %s just entered: " + k
print j % "John"

Traceback (most recent call last):
File "<pyshell#8 >", line 1, in ?
print j % "John"
TypeError: not enough arguments for format string

That's hardly the same sort of vulnerability the article was talking
about, but it is a potential bug waiting to bite.

In a serious application, you should keep user-inputted strings separate
from application strings, and never use user strings unless they've been
made safe. See Joel Spolsky's excellent article about one way of doing
that:

http://www.joelonsoftware.com/articles/Wrong.html

--
Steven.

[Jeremy Sanders]

Steven D'Aprano wrote:

os.system('dir -l %s' % 'text.txt')
Now, there is a security risk: you might set command1 yourself, and
allow the user to set args. If command1 is an external application
with a security hole, and the user provides arguments that trigger that
bug, then naturally your application will inherit whatever security
vulnerabilities the external application suffers from. No surprises there.

There are also big risks like this

filename = 'foo; rm importantfile'
cmd = 'ls %s' % filename
os.system(cmd)

oops!

--
Jeremy Sanders
http://www.jeremysanders.net/

[Eric_Dexter]

I will give the formatting a try. I noticed another formatting thing I
wasn't looking for. It is possible to have a \n at the end of a word
or at least that is how it is shown and fixed through python 2.5. I
had an error where 36\n isn't a number. easy to fix though.
Jeremy Sanders wrote:

Steven D'Aprano wrote:

os.system('dir -l %s' % 'text.txt')
Now, there is a security risk: you might set command1 yourself, and
allow the user to set args. If command1 is an external application
with a security hole, and the user provides arguments that trigger that
bug, then naturally your application will inherit whatever security
vulnerabilities the external application suffers from. No surprises there.

There are also big risks like this

filename = 'foo; rm importantfile'
cmd = 'ls %s' % filename
os.system(cmd)

oops!

--
Jeremy Sanders
http://www.jeremysanders.net/