Crunchy security advisory
andre.roberge at gmail.com
Sun Jul 29 01:13:05 CEST 2007
A security hole has been uncovered in Crunchy (version 0.9.1.1 and
Anyone using Crunchy to browse web tutorials should only visit sites
that are trustworthy.
We are working hard at fixing the hole; a new release addressing the
problems that have
been found should be forthcoming shortly.
The security problem is as follows:
such code) that would bypass Crunchy's filter to be executed by the
to send some
Python code directly to the Python backend (i.e. without the Crunchy
user pressing a button, or having the chance to view the code to be
executed) so that it is executed. Such code could result in deleting
the entire files or installing some virus on the user's machine.
At the moment, the risk is pretty low. Crunchy already removes all
etc. The holes found require the use of some uncommon combination of
html and css code, with a particular knowledge of Firefox.
(Note that browsers other than Firefox are likely to be even more
Furthermore, Crunchy is not that well known that it is likely to
be a target by a cracker that would 1) write a "tutorial" interesting
enough to lure current Crunchy users (who, at this point, are
likely to include only advanced Python users) and 2) write some fairly
commands enabling communication between the browser and crunchy are
made up of random string generated uniquely at each new Crunchy
If anyone is interested in security issues related to Crunchy, feel
contact me directly.
More information about the Python-list