Skip to content

Security bug in tkinter allows for untrusted, arbitrary code execution. #60452

Closed
Closed
Security bug in tkinter allows for untrusted, arbitrary code execution.#60452
Labels
release-blockertopic-tkintertype-securityA security issue

Description

@RamchandraApte
RamchandraApte
mannequin
opened on Oct 16, 2012
BPO 16248
Nosy @warsaw, @birkenfeld, @terryjreedy, @mdickinson, @pitrou, @larryhastings, @tiran, @benjaminp, @asvetlov, @skrah, @zware
Files
  • exploit.py
  • issue16248-2.x.patch: 2.x patch
  • issue16248-3.x.patch: 3.x patch
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2013-09-15.19:59:57.526>
created_at = <Date 2012-10-16.15:29:21.664>
labels = ['type-security', 'expert-tkinter', 'release-blocker']
title = 'Security bug in tkinter allows for untrusted, arbitrary code execution.'
updated_at = <Date 2013-09-15.19:59:57.525>
user = 'https://bugs.python.org/RamchandraApte'

    bugs.python.org fields:

    activity = <Date 2013-09-15.19:59:57.525>
actor = 'pitrou'
assignee = 'none'
closed = True
closed_date = <Date 2013-09-15.19:59:57.526>
closer = 'pitrou'
components = ['Tkinter']
creation = <Date 2012-10-16.15:29:21.664>
creator = 'Ramchandra Apte'
dependencies = []
files = ['27823', '27937', '27938']
hgrepos = []
issue_num = 16248
keywords = ['patch']
message_count = 64.0
messages = ['173047', '173048', '173050', '173051', '173125', '173191', '173230', '173231', '173278', '174299', '174300', '174317', '174319', '174396', '174420', '174429', '174450', '174460', '174462', '174463', '174464', '174466', '174469', '174471', '174476', '174479', '174488', '174509', '174553', '174556', '174813', '175253', '177218', '177219', '177220', '177222', '182507', '182511', '182524', '182525', '182526', '182527', '182532', '182565', '182566', '182568', '182569', '194091', '194094', '194096', '194112', '194114', '194639', '195091', '195093', '195599', '195600', '195737', '195738', '197689', '197690', '197697', '197825', '197826']
nosy_count = 15.0
nosy_names = ['barry', 'georg.brandl', 'terry.reedy', 'mark.dickinson', 'pitrou', 'larry', 'christian.heimes', 'benjamin.peterson', 'gpolo', 'Arfrever', 'asvetlov', 'skrah', 'python-dev', 'Ramchandra Apte', 'zach.ware']
pr_nums = []
priority = 'release blocker'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue16248'
versions = ['Python 3.1']

    Activity

    1. RamchandraApte commented on Oct 16, 2012

      @RamchandraApte
      RamchandraAptemannequin
      on Oct 16, 2012
      MannequinAuthor

      Because tkinter.py uses exec to execute code from a file, it has a security bug. It searches for the file in the home dir. Apparently, on my system (don't know if its the same on others), the $HOME variable is the same as the non-root one when running Python with root priveleges
      Steps to reproduce:
      create a file called .Tk.py in your home folder
      Whatever code is in that file will be executed.

      run these three lines of code in Python:

      import tkinter
w = tkinter.Tk()
w.mainloop()

      I will add more details in later comments.

    2. RamchandraApte
      added
      topic-tkinter
      type-securityA security issue
      on Oct 16, 2012

    3. RamchandraApte commented on Oct 16, 2012

      @RamchandraApte
      RamchandraAptemannequin
      on Oct 16, 2012
      MannequinAuthor

      s/tkinter.py/tkinter.__init__

    4. RamchandraApte commented on Oct 16, 2012

      @RamchandraApte
      RamchandraAptemannequin
      on Oct 16, 2012
      MannequinAuthor

      In Lib/tkinter/init.py:1801 , the readprofile function executes untrusted code.

    5. RamchandraApte commented on Oct 16, 2012

      @RamchandraApte
      RamchandraAptemannequin
      on Oct 16, 2012
      MannequinAuthor

      specifically, when running Python using sudo (not in a root shell), the $HOME variable is preserved.

    6. RamchandraApte commented on Oct 17, 2012

      @RamchandraApte
      RamchandraAptemannequin
      on Oct 17, 2012
      MannequinAuthor

      I made many mistakes in the original bug report. Here is a fixed one:

      Because Lib/tkinter/init.py:1801 uses exec to execute code from a file, it has a security bug. It searches for the file in the home dir. Apparently, on my system, the $HOME variable is the same as the non-root one when running Python with root privileges using sudo.

      Steps to reproduce:
      create a file called .Tk.py in your home folder
      Whatever code is in that file will be executed.

      run these three lines of code in Python using sudo:

      import tkinter
w = tkinter.Tk()

      And the code in the .Tk.py will be executed (unless if you change the baseName for the Tk object)
      There may be similar ways of running Python with root privileges preserving the environment variables in other OS'es
      Using Kubuntu Linux (variant of Ubuntu Linux) 12.04

    7. RamchandraApte
      changed the title [-]Security bug in tkinter allows for untrusted code execution.[/-] [+]Security bug in tkinter allows for untrusted, arbitrary code execution.[/+] on Oct 17, 2012

    8. gpolo commented on Oct 17, 2012

      @gpolo
      gpolomannequin
      on Oct 17, 2012
      Mannequin

      It is a well known fact that the readprofile function uses exec, and it has been like that for more than 18 years. The parameters baseName and className defines the execution of the files $HOME/.{className}.tcl, $HOME/.{className}.py, $HOME/.{baseName}.tcl, and $HOME/.{baseName}.py. The function's docstring actually say that.

      Said that, I never needed to load custom code during the creation of a Tk instance. To me the existence of readprofile is unneeded.

      But what is your proposal to the issue ?

    9. WanttoDeleteThisAccount commented on Oct 18, 2012

      @WanttoDeleteThisAccount
      WanttoDeleteThisAccountmannequin
      on Oct 18, 2012
      Mannequin

      On 17 October 2012 23:46, Guilherme Polo <report@bugs.python.org> wrote:

      Guilherme Polo added the comment:

      It is a well known fact that the readprofile function uses exec, and it
      has been like that for more than 18 years. The parameters baseName and
      className defines the execution of the files $HOME/.{className}.tcl,
      $HOME/.{className}.py, $HOME/.{baseName}.tcl, and $HOME/.{baseName}.py. The
      function's docstring actually say that.

      Said that, I never needed to load custom code during the creation of a Tk
      instance. To me the existence of readprofile is unneeded.

      But what is your proposal to the issue ?

      ----------

      Python tracker <report@bugs.python.org>
      <http://bugs.python.org/issue16248\>

      Simply remove the readprofile code (it is not documented and I never had to
      use it)

    10. RamchandraApte commented on Oct 18, 2012

      @RamchandraApte
      RamchandraAptemannequin
      on Oct 18, 2012
      MannequinAuthor

      Apparently when replying by email my old account name is shown ("mani and ram") Just so you know that "mani and ram" is me.

    11. gpolo commented on Oct 18, 2012

      @gpolo
      gpolomannequin
      on Oct 18, 2012
      Mannequin

      For something that has been around for so long, I would be a little more careful.

      My suggestion is: no longer declare readprofile as an internal function; remove the direct call to readprofile from Tk.__init__; tell users about the new behavior, and the need to call readprofile themselves if they wish to.

      In some years we might be able to estimate if readprofile is used at all, and then decide about removing it. Since I haven't been active as a Python committer, I will let the final decision to someone else.

    12. RamchandraApte commented on Oct 31, 2012

      @RamchandraApte
      RamchandraAptemannequin
      on Oct 31, 2012
      MannequinAuthor

      It is possible with this bug to make a sudo IDLE edit a root-file.

    13. RamchandraApte commented on Oct 31, 2012

      @RamchandraApte
      RamchandraAptemannequin
      on Oct 31, 2012
      MannequinAuthor

      oops ignore last msg

    14. gpolo commented on Oct 31, 2012

      @gpolo
      gpolomannequin
      on Oct 31, 2012
      Mannequin

      I can ignore it, but let us be honest. If you got sudo privilege already, why are you bothering to break (or whatever else) the system using IDLE ? The issue here did not give you the sudo privilege. If it did, then we have an actual security bug.

    15. 52 remaining items

    16. benjaminp commented on Aug 19, 2013

      @benjaminp
      benjaminp
      on Aug 19, 2013
      Contributor

      3.2 is owned by Georg.

    17. benjaminp commented on Aug 19, 2013

      @benjaminp
      benjaminp
      on Aug 19, 2013
      Contributor

      As for 3.1, feel free to apply. There will likely be a source release of it at some point.

    18. python-dev commented on Aug 21, 2013

      @python-dev
      python-devmannequin
      on Aug 21, 2013
      Mannequin

      New changeset 84f40562669f by Barry Warsaw in branch '2.6':
      Fix UnboundLocalError regression due to previous incorrect fix for
      http://hg.python.org/cpython/rev/84f40562669f

    19. warsaw commented on Aug 21, 2013

      @warsaw
      warsaw
      on Aug 21, 2013
      Member

      Applied the fix to 2.6 and null merged into 2.7. This didn't need a NEWS entry because the regression hadn't been released yet. I'll remove 2.6 from the Versions now.

    20. birkenfeld commented on Sep 14, 2013

      @birkenfeld
      birkenfeld
      on Sep 14, 2013
      Member

      Should be fixed now in 3.2 too.

    21. birkenfeld
      closed this as completedon Sep 14, 2013

    22. python-dev commented on Sep 14, 2013

      @python-dev
      python-devmannequin
      on Sep 14, 2013
      Mannequin

      New changeset c18c18774e24 by Georg Brandl in branch '3.2':
      Fix tkinter regression introduced by the security fix in bpo-16248.
      http://hg.python.org/cpython/rev/c18c18774e24

    23. Arfrever commented on Sep 14, 2013

      @Arfrever
      Arfrevermannequin
      on Sep 14, 2013
      Mannequin

      Fix still needs to be applied on 3.1 branch.

    24. Arfrever
      reopened this on Sep 14, 2013
    25. Arfrever
      added
      release-blocker
      and removed
      deferred-blocker
      on Sep 14, 2013

    26. python-dev commented on Sep 15, 2013

      @python-dev
      python-devmannequin
      on Sep 15, 2013
      Mannequin

      New changeset c39f42f46a05 by Georg Brandl in branch '3.1':
      Fix tkinter regression introduced by the security fix in bpo-16248.
      http://hg.python.org/cpython/rev/c39f42f46a05

    27. pitrou commented on Sep 15, 2013

      @pitrou
      pitrou
      on Sep 15, 2013
      Member

      Fix backported to 3.1, closing.

    28. pitrou
      closed this as completedon Sep 15, 2013
    29. ezio-melotti
      transferred this issue fromon Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Metadata

    Metadata

    Assignees

    No one assigned

      Labels

      release-blockertopic-tkintertype-securityA security issue

      Projects

      No projects

        Milestone

        No milestone

        Relationships

        None yet

        Development

        No branches or pull requests

        Issue actions