CVE-2018-1000117

CPython Buffer Overflow in os.symlink

• CVSS 6.7
• CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
• Memory Corruption
• Remote

Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in os.symlink() function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python script that creates a symlink with an attacker controlled name or location. This vulnerability appears to have been fixed in 3.7.0 and 3.6.5.

CVE

CVE-2018-1000117

CWE

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVSS base score

6.7

Published

2018-03-07

OWASP

A04 Insecure Design

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Memory Corruption

Subcategory

Buffer Overflows

Accessibility scope

Remote

Impact

Arbitrary Code Execution, Privilege Escalation

Fixed by upgrading

Yes

Solution

Update to Python version 3.7.0 or 3.6.5.

import os

def vulnerable_symlink(target, link_name):
    os.symlink(target, link_name)

if __name__ == "__main__":
    attacker_controlled_target = "C:\\path\\to\\target"
    attacker_controlled_link_name = "C:\\path\\to\\link"

    try:
        vulnerable_symlink(attacker_controlled_target, attacker_controlled_link_name)
        print("Symlink created successfully.")
    except Exception as e:
        print("Error creating symlink:", e)

import os

def secure_symlink(target, link_name):
    if len(link_name) > 260:
        raise ValueError("link_name exceeds maximum path length.")

    if not os.path.exists(target):
        raise ValueError("Target does not exist.")

    os.symlink(target, link_name)

if __name__ == "__main__":
    try:
        secure_symlink("C:\\path\\to\\target", "C:\\path\\to\\link")
        print("Symlink created successfully.")
    except Exception as e:
        print("Error creating symlink:", e)

@misc{vaitp:cve20181000117,
  title        = {{CPython Buffer Overflow in os.symlink}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2018},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2018-1000117},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2018-1000117/}}
}