Google App Engine SDK (CVE-2011-4212) Local Arbitrary Command Execution Vulnerability

Bugtraq ID:	50467
Class:	Design Error
CVE:	CVE-2011-4212
Remote:	No
Local:	Yes
Published:	Oct 11 2011 12:00AM
Updated:	Oct 11 2011 12:00AM
Credit:	Adi Sharabani of IBM
Vulnerable:	Google Google App Engine 1.5.3 Google Google App Engine 1.5 Google Google App Engine 1.0
Not Vulnerable:	Google Google App Engine 1.5.4

Google App Engine SDK (CVE-2011-4212) Local Arbitrary Command Execution Vulnerability

Google App Engine SDK is prone to a vulnerability that can allow local attackers to execute arbitrary commands.

Local attackers can exploit this issue to execute arbitrary commands with elevated privileges, bypass certain security restrictions, and perform unauthorized actions.

Google App Engine versions prior to 1.5.4 are vulnerable.

Google App Engine SDK (CVE-2011-4212) Local Arbitrary Command Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Google App Engine SDK (CVE-2011-4212) Local Arbitrary Command Execution Vulnerability

Solution:
Updates are available. Please see the reference for more details.

Google App Engine SDK (CVE-2011-4212) Local Arbitrary Command Execution Vulnerability

References:

• A Code Execution Vulnerability in Google App Engine SDK for Python: A Security A (Watchfire)
  
• Google App Engine SDK (Google)