oss-security - Directory traversal in sharutils/uudecode and python uu module

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221221194203.40e37b41@computer>
Date: Wed, 21 Dec 2022 19:42:03 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Directory traversal in sharutils/uudecode and python uu module

Hi

uuencode is an old method to encode binary data in ascii.

uuencoded files start with a line of this type:
begin 644 [filename]

If the implementation does not check for it this allows a directory
traversal attack, e.g. like this:
begin 644 /etc/shadow

Or
begin 644 ../../../../../etc/shadow

If one can convince someone with root privileges to decode such a file
this may thus compromise a system.

I discovered two implementations vulnerable to this: The uudecode tool
shipped with GNU sharutils and the uu module in python (only if no
explicit filename is given). Both are vulnerable to both variations.

I reported both on November 27th. The python security team asked me to
report it to their public bug tracker, as they don't consider it a high
risk issue:
https://github.com/python/cpython/issues/99889

The python uu module is deprecated and will be removed in python 3.13.
The python developers pointed out that it is rarely used, and it is not
vulnerable if an output file name is given.
The python binascii module contains an uu decoder that is unaffected
(as it does not directly write a file, it decodes to a variable) and no
deprecation or removal is planned. I guess this means if you're using
the python uu module you should probably switch to binascii.

I got a reply confirming the report from the sharutils developers,
pointing out that this can be interpreted as expected behavior
according to the posix standard. I don't expect a fix any time soon,
their latest release is from 2015.

-- 
Hanno Böck
https://hboeck.de/

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.