The find_library() function can execute code when special chars like ;|`<>$ are in the name.
The "os.popen()" calls in the util.py script should be replaced with "subprocess.Popen()".

Demo Exploits for Linux :
====================

>>> from ctypes.util import find_library
>>> find_library(";xeyes") # runs xeyes
>>> find_library("|xterm") # runs terminal
>>> find_library("&gimp") # runs gimp
>>> find_library("$(nautilus)") # runs filemanager
>>> find_library(">test") # creates, and if exists, erases a file "test"

==== Traceback ====

>>> find_library("`xmessage hello`") # shows a message, press ctrl+c for Traceback
^CTraceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.4/ctypes/util.py", line 244, in find_library
    return _findSoname_ldconfig(name) or _get_soname(_findLib_gcc(name))
  File "/usr/lib/python3.4/ctypes/util.py", line 99, in _findLib_gcc
    trace = f.read()
KeyboardInterrupt


https://bugs.launchpad.net/ubuntu/+source/python2.7/+bug/1512068

There is a patch at Issue 22636 which looks like it replaces all five os.popen() calls.

Your Ubuntu link seems broken, or is that a private report?

i made the ubuntu link readable for everyone.

Whilst fixed in 3.5, it is not fixed in 2.7. And the reporter believes this is a security vulnerability.

Can this be cherry-picked into the 2.7 branch?

I do not believe 3.5 is fixed either:

$ python3.5
Python 3.5.0 (default, Sep 20 2015, 11:28:25) 
[GCC 5.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import ctypes.util
>>> ctypes.util.find_library("; echo Hello shell >&2")
Hello shell
>>> 

Issue 22636 has a patch with some review comments, but is is still open. I think it needs someone to take another look, perhaps update the patch, and get it committed.

I will mark the other issue as a bug fix for 2.7 and 3.4+.

nosy: + martin.panter
messages: + msg255523

superseder: avoid using a shell in ctypes.util: replace os.popen with subprocess
resolution: duplicate