distutils : file "bdist_rpm.py" allows Shell injection in "name"

[Bernd Dietzel]

File :
/usr/lib/python2.7/distutils/command/bdist_rpm.py

Line 358 :
This line in the code uses the depreached os.popen command, should be replaced with subprocess.Popen() :

out = os.popen(q_cmd)

Exploit demo :
============
1) Download the setup.py script wich i attached
2) Create a test folder an put the setup.py script in this folder
3) cd to the test folder
4) python setup.py bdist_rpm
5) A xmessage window pops up as a proof of concept

ProblemType: Bug
DistroRelease: Ubuntu 15.10
Package: libpython2.7-stdlib 2.7.10-4ubuntu1
ProcVersionSignature: Ubuntu 4.2.0-17.21-generic 4.2.3
Uname: Linux 4.2.0-17-generic x86_64
NonfreeKernelModules: wl
ApportVersion: 2.19.1-0ubuntu4
Architecture: amd64
CurrentDesktop: Unity
Date: Sun Nov 8 13:47:34 2015
InstallationDate: Installed on 2015-10-22 (16 days ago)
InstallationMedia: Ubuntu 15.10 "Wily Werewolf" - Release amd64 (20151021)
SourcePackage: python2.7
UpgradeStatus: No upgrade log present (probably fresh install)

[Tyler Hicks (tyhicks)]

Hi Bernd - Thanks for the bug report! While I think that this is something that should be fixed upstream, I don't feel like it is a security issue.

By running `python setup.py ...`, you're already trusting that setup.py is not malicious. It could execute xmessage directly.

Do you know if there are any other ways to trigger the problematic popen() call that doesn't require executing the Python script that has the malicious program name?

Have you reported this issue to upstream Python?

[Bernd Dietzel (l-ubuntuone1104)]

Hello Tyler,
i only used the setup script because the distutils.core.setup() function takes such a large number of arguments, so its more easy to read than in one single line of code.

No, i haven't reported this issue to upstream.

[Bernd Dietzel (l-ubuntuone1104)]

Reported to Upstream :
http://bugs.python.org/issue25627