Vulnerabilities > CVE-2005-2875 - Remote Python Code Execution vulnerability in Py2Play Object Unpickling
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Py2Play allows remote attackers to execute arbitrary Python code via pickled objects, which Py2Play unpickles and executes.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 1 |
Nessus
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200509-09.NASL description The remote host is affected by the vulnerability described in GLSA-200509-09 (Py2Play: Remote execution of arbitrary Python code) Arc Riley discovered that Py2Play uses Python pickles to send objects over a peer-to-peer game network, and that clients accept without restriction the objects and code sent by peers. Impact : A remote attacker participating in a Py2Play-powered game can send malicious Python pickles, resulting in the execution of arbitrary Python code on the targeted game client. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 19741 published 2005-09-17 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/19741 title GLSA-200509-09 : Py2Play: Remote execution of arbitrary Python code code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Gentoo Linux Security Advisory GLSA 200509-09. # # The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc. # and licensed under the Creative Commons - Attribution / Share Alike # license. See http://creativecommons.org/licenses/by-sa/3.0/ # include("compat.inc"); if (description) { script_id(19741); script_version("1.14"); script_cvs_date("Date: 2019/08/02 13:32:42"); script_cve_id("CVE-2005-2875"); script_xref(name:"GLSA", value:"200509-09"); script_name(english:"GLSA-200509-09 : Py2Play: Remote execution of arbitrary Python code"); script_summary(english:"Checks for updated package(s) in /var/db/pkg"); script_set_attribute( attribute:"synopsis", value: "The remote Gentoo host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The remote host is affected by the vulnerability described in GLSA-200509-09 (Py2Play: Remote execution of arbitrary Python code) Arc Riley discovered that Py2Play uses Python pickles to send objects over a peer-to-peer game network, and that clients accept without restriction the objects and code sent by peers. Impact : A remote attacker participating in a Py2Play-powered game can send malicious Python pickles, resulting in the execution of arbitrary Python code on the targeted game client. Workaround : There is no known workaround at this time." ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/200509-09" ); script_set_attribute( attribute:"solution", value: "All py2play users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-python/py2play-0.1.8'" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:py2play"); script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux"); script_set_attribute(attribute:"patch_publication_date", value:"2005/09/17"); script_set_attribute(attribute:"plugin_publication_date", value:"2005/09/17"); script_set_attribute(attribute:"vuln_publication_date", value:"2005/09/06"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc."); script_family(english:"Gentoo Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("qpkg.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo"); if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (qpkg_check(package:"dev-python/py2play", unaffected:make_list("ge 0.1.8"), vulnerable:make_list("le 0.1.7"))) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get()); else security_hole(0); exit(0); } else { tested = qpkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Py2Play"); }
NASL family Debian Local Security Checks NASL id DEBIAN_DSA-856.NASL description Arc Riley discovered that py2play, a peer-to-peer network game engine, is able to execute arbitrary code received from the p2p game network it is connected to without any security checks. last seen 2020-06-01 modified 2020-06-02 plugin id 19964 published 2005-10-11 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/19964 title Debian DSA-856-1 : py2play - design error
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=326976
- http://secunia.com/advisories/16855
- http://secunia.com/advisories/17106
- http://soya.literati.org/
- http://www.debian.org/security/2005/dsa-856
- http://www.gentoo.org/security/en/glsa/glsa-200509-09.xml
- http://www.securityfocus.com/bid/14864
- https://bugs.gentoo.org/show_bug.cgi?id=103524