[ZODB-Dev] ZEO Server Security (long)

[Toby Dickenson]

On Tuesday 07 January 2003 9:04 am, Toby Dickenson wrote:

<snip>

> Unfortunately the current ZEO *server* performs an unpickle operation o=
n
> data provided by the client in several places. This means that any clie=
nt
> can unconditionally compromise the ZEO server by sending a trojan pickl=
e.
> This attack can be launched by anything that can connect to the ZEO ser=
ver,
> and is unaffected by precautions such as server-side read-only flags, a=
nd
> server authentication.

Fixing this completely is harder than I thought. Server-side conflict=20
resolution needs to be able to unpickle aribtrary client-supplied pickles=
=2E=20
Fortunately this cant be used to bypass a read-only flag or authenticatio=
n.

--=20
Toby Dickenson
http://www.geminidataloggers.com/people/tdickenson