Pickle漏洞利用与防御  

Pickle Vulnerability Exploitation and Defense

作　　者：贺琪茗[1] 周安民[1] 方勇[1] 刘亮[1] 

机构地区：[1]四川大学信息安全研究所,四川成都610064

出　　处：《信息安全与通信保密》2012年第6期67-69,共3页Information Security and Communications Privacy

摘　　要：Pickle漏洞是由于没有安全使用Python模块Pickle漏洞而产生的。由于Python语言的跨平台性,shellcode制作的简易性,使得漏洞的危害性很大。整篇文章细致阐述了Pickle漏洞的利用环境、利用方式以及shellcode的编写过程,向读者剖析了漏洞的产生原因,然后总结了各种有效针对Pickle漏洞的防御策略。最后通过软件调查结果,表明了该漏洞的广泛性和安全使用Pickle模块的必要性。Pickle vulnerabilities are resulted from unsafe use of pickle---a python module. Due to the crossplatform ability of python and simplicity of shellcode writing, pickle vulnerabilities are even more harmful. This paper principally describes the utilization environment and mode of pickle vulnerabilities, including the process of shellcode writing, and sums up a variety of effective defense strategies for pickle vulnerabilitiesFinally through the survey of software, this paper tells of the universality of these vulnerabilities and the necessity for safe use of pickle module.

关 键 词：pickle模块 PYTHON语言 shellcode代码 漏洞 攻击 防御 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]