CVE-2014-1933

Symlink Attack Vulnerability in Python Image Library (PIL) 1.1.7

• CVSS 2.1
• CWE-264: Permissions, Privileges, and Access Controls
• Race Conditions
• Local

The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 use the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.

CVE

CVE-2014-1933

CWE

CWE-264: Permissions, Privileges, and Access Controls

CVSS base score

2.1

Published

2014-04-17

OWASP

A01 Broken Access Control

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Race Conditions

Subcategory

Race Condition in File Operations

Accessibility scope

Local

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Python Image Library (PIL) to version 1.1.7 or later, or Pillow to version 2.3.1 or later.

import socket

def recvfrom_into():
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.bind(('localhost', 12345))

    buffer = bytearray(1024)
    nbytes, address = sock.recvfrom_into(buffer)
    print(f"Received {nbytes} bytes from {address}")

import socket

def recvfrom_into():
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.bind(('localhost', 12345))

    buffer = bytearray(1024)
    temp_buffer = bytearray(2048)
    nbytes, address = sock.recvfrom_into(temp_buffer)
    
    if nbytes > len(buffer):
        print("Warning: received more data than expected. Truncating...")
        nbytes = len(buffer)
        buffer[:] = temp_buffer[:nbytes]
    else:
        buffer[:] = temp_buffer[:nbytes]
    
    print(f"Safely received {nbytes} bytes from {address}")

@misc{vaitp:cve20141933,
  title        = {{Symlink Attack Vulnerability in Python Image Library (PIL) 1.1.7}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2014},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2014-1933},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2014-1933/}}
}