full-disclosure - Google App Enging SDK Code Execution Vulnerability (CVE 2011-1364)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 11 Oct 2011 22:51:07 +0200
From: Adi Sharabani <adish@...ibm.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Google App Enging SDK Code Execution
	Vulnerability (CVE 2011-1364)

We recently identified an interesting code execution vulnerability in the
Google App Engine SDK for Python. By combining a CSRF vulnerability in the
administration web UI, with some other unique vulnerabilities we found in
the Google python libraries, a remote hacker could gain remote code
execution privileges on victim's machine. This vulnerability affects all
operation systems running Google App Engine SDK for python (i.e. Windows,
Mac OS, etc.).

Full advisory can be found at:

http://blog.watchfire.com/wfblog/2011/10/google-app-engine-cve-2011-1364.html

-Adish
Adi Sharabani
Security Strategist, Master Inventor, IBM

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/