Multiple integer overflows in imageop.c in Python before 2.5.3 allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted images that trigger heap-based buffer overflows. NOTE: this issue is due to an incomplete fix for CVE-2007-4965.

From Red Hat Security Advisory 2009:1178 :

Updated python packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Python is an interpreted, interactive, object-oriented programming language.

When the assert() system call was disabled, an input sanitization flaw was revealed in the Python string object implementation that led to a buffer overflow. The missing check for negative size values meant the Python memory allocator could allocate less memory than expected. This could result in arbitrary code execution with the Python interpreter's privileges. (CVE-2008-1887)

Multiple buffer and integer overflow flaws were found in the Python Unicode string processing and in the Python Unicode and string object implementations. An attacker could use these flaws to cause a denial of service (Python application crash). (CVE-2008-3142, CVE-2008-5031)

Multiple integer overflow flaws were found in the Python imageop module. If a Python application used the imageop module to process untrusted images, it could cause the application to crash or, potentially, execute arbitrary code with the Python interpreter's privileges. (CVE-2008-1679, CVE-2008-4864)

Multiple integer underflow and overflow flaws were found in the Python snprintf() wrapper implementation. An attacker could use these flaws to cause a denial of service (memory corruption). (CVE-2008-3144)

Multiple integer overflow flaws were found in various Python modules.
An attacker could use these flaws to cause a denial of service (Python application crash). (CVE-2008-2315, CVE-2008-3143)

Red Hat would like to thank David Remahl of the Apple Product Security team for responsibly reporting the CVE-2008-1679 and CVE-2008-2315 issues.

All Python users should upgrade to these updated packages, which contain backported patches to correct these issues.

From Red Hat Security Advisory 2009:1177 :

Updated python packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Python is an interpreted, interactive, object-oriented programming language.

When the assert() system call was disabled, an input sanitization flaw was revealed in the Python string object implementation that led to a buffer overflow. The missing check for negative size values meant the Python memory allocator could allocate less memory than expected. This could result in arbitrary code execution with the Python interpreter's privileges. (CVE-2008-1887)

Multiple buffer and integer overflow flaws were found in the Python Unicode string processing and in the Python Unicode and string object implementations. An attacker could use these flaws to cause a denial of service (Python application crash). (CVE-2008-3142, CVE-2008-5031)

Multiple integer overflow flaws were found in the Python imageop module. If a Python application used the imageop module to process untrusted images, it could cause the application to crash or, potentially, execute arbitrary code with the Python interpreter's privileges. (CVE-2008-1679, CVE-2008-4864)

Multiple integer underflow and overflow flaws were found in the Python snprintf() wrapper implementation. An attacker could use these flaws to cause a denial of service (memory corruption). (CVE-2008-3144)

Multiple integer overflow flaws were found in various Python modules.
An attacker could use these flaws to cause a denial of service (Python application crash). (CVE-2008-2315, CVE-2008-3143)

An integer signedness error, leading to a buffer overflow, was found in the Python zlib extension module. If a Python application requested the negative byte count be flushed for a decompression stream, it could cause the application to crash or, potentially, execute arbitrary code with the Python interpreter's privileges.
(CVE-2008-1721)

Red Hat would like to thank David Remahl of the Apple Product Security team for responsibly reporting the CVE-2008-1679 and CVE-2008-2315 issues.

All Python users should upgrade to these updated packages, which contain backported patches to correct these issues.

When the assert() system call was disabled, an input sanitization flaw was revealed in the Python string object implementation that led to a buffer overflow. The missing check for negative size values meant the Python memory allocator could allocate less memory than expected. This could result in arbitrary code execution with the Python interpreter's privileges. (CVE-2008-1887)

Multiple buffer and integer overflow flaws were found in the Python Unicode string processing and in the Python Unicode and string object implementations. An attacker could use these flaws to cause a denial of service (Python application crash). (CVE-2008-3142, CVE-2008-5031)

Multiple integer overflow flaws were found in the Python imageop module. If a Python application used the imageop module to process untrusted images, it could cause the application to crash or, potentially, execute arbitrary code with the Python interpreter's privileges. (CVE-2008-1679, CVE-2008-4864)

Multiple integer underflow and overflow flaws were found in the Python snprintf() wrapper implementation. An attacker could use these flaws to cause a denial of service (memory corruption). (CVE-2008-3144)

Multiple integer overflow flaws were found in various Python modules.
An attacker could use these flaws to cause a denial of service (Python application crash). (CVE-2008-2315, CVE-2008-3143)

An integer signedness error, leading to a buffer overflow, was found in the Python zlib extension module. If a Python application requested the negative byte count be flushed for a decompression stream, it could cause the application to crash or, potentially, execute arbitrary code with the Python interpreter's privileges.
(CVE-2008-1721)

Would like to thank David Remahl of the Apple Product Security team for responsibly reporting the CVE-2008-1679 and CVE-2008-2315 issues.

When the assert() system call was disabled, an input sanitization flaw was revealed in the Python string object implementation that led to a buffer overflow. The missing check for negative size values meant the Python memory allocator could allocate less memory than expected. This could result in arbitrary code execution with the Python interpreter's privileges. (CVE-2008-1887)

Multiple buffer and integer overflow flaws were found in the Python Unicode string processing and in the Python Unicode and string object implementations. An attacker could use these flaws to cause a denial of service (Python application crash). (CVE-2008-3142, CVE-2008-5031)

Multiple integer overflow flaws were found in the Python imageop module. If a Python application used the imageop module to process untrusted images, it could cause the application to crash or, potentially, execute arbitrary code with the Python interpreter's privileges. (CVE-2008-1679, CVE-2008-4864)

Multiple integer underflow and overflow flaws were found in the Python snprintf() wrapper implementation. An attacker could use these flaws to cause a denial of service (memory corruption). (CVE-2008-3144)

Multiple integer overflow flaws were found in various Python modules.
An attacker could use these flaws to cause a denial of service (Python application crash). (CVE-2008-2315, CVE-2008-3143)

Would like to thank David Remahl of the Apple Product Security team for responsibly reporting the CVE-2008-1679 and CVE-2008-2315 issues.

This update of python fixes several security vulnerabilities.
(CVE-2008-1679 / CVE-2008-1887, CVE-2008-3143, CVE-2008-3142, CVE-2008-3144, CVE-2008-2315, CVE-2008-2316)

Note: for SLE10 a non-security bug in mmap was fixed too.

Updated python packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Python is an interpreted, interactive, object-oriented programming language.

When the assert() system call was disabled, an input sanitization flaw was revealed in the Python string object implementation that led to a buffer overflow. The missing check for negative size values meant the Python memory allocator could allocate less memory than expected. This could result in arbitrary code execution with the Python interpreter's privileges. (CVE-2008-1887)

Multiple buffer and integer overflow flaws were found in the Python Unicode string processing and in the Python Unicode and string object implementations. An attacker could use these flaws to cause a denial of service (Python application crash). (CVE-2008-3142, CVE-2008-5031)

Multiple integer overflow flaws were found in the Python imageop module. If a Python application used the imageop module to process untrusted images, it could cause the application to crash or, potentially, execute arbitrary code with the Python interpreter's privileges. (CVE-2008-1679, CVE-2008-4864)

Multiple integer underflow and overflow flaws were found in the Python snprintf() wrapper implementation. An attacker could use these flaws to cause a denial of service (memory corruption). (CVE-2008-3144)

Multiple integer overflow flaws were found in various Python modules.
An attacker could use these flaws to cause a denial of service (Python application crash). (CVE-2008-2315, CVE-2008-3143)

Red Hat would like to thank David Remahl of the Apple Product Security team for responsibly reporting the CVE-2008-1679 and CVE-2008-2315 issues.

All Python users should upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:1177 advisory.

  - python: imageop module integer overflows (CVE-2008-1679)

  - python: integer signedness error in the zlib extension module (CVE-2008-1721)

  - python: PyString_FromStringAndSize does not check for negative size values (CVE-2008-1887)

  - python: Multiple integer overflows in python core (CVE-2008-2315)

  - python: Multiple buffer overflows in unicode processing (CVE-2008-3142)

  - python: Multiple integer overflows discovered by Google (CVE-2008-3143)

  - python: Potential integer underflow and overflow in the PyOS_vsnprintf C API function (CVE-2008-3144)

  - python: imageop module multiple integer overflows (CVE-2008-4864)

  - python: stringobject, unicodeobject integer overflows (CVE-2008-5031)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of python fixes several security vulnerabilities.
(CVE-2008-1679,CVE-2008-1887, CVE-2008-3143, CVE-2008-3142, CVE-2008-3144, CVE-2008-2315, CVE-2008-2316)

Multiple integer overflows in the imageop module in Python prior to 2.5.3 allowed context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted images that trigger heap-based buffer overflows (CVE-2008-1679). This was due to an incomplete fix for CVE-2007-4965.

David Remahl of Apple Product Security reported several integer overflows in a number of core modules (CVE-2008-2315). He also reported an integer overflow in the hashlib module on Python 2.5 that lead to unreliable cryptographic digest results (CVE-2008-2316).

Justin Ferguson reported multiple buffer overflows in unicode string processing that affected 32bit systems (CVE-2008-3142).

Multiple integer overflows were reported by the Google Security Team that had been fixed in Python 2.5.2 (CVE-2008-3143).

Justin Ferguson reported a number of integer overflows and underflows in the PyOS_vsnprintf() function, as well as an off-by-one error when passing zero-length strings, that led to memory corruption (CVE-2008-3144).

The updated packages have been patched to correct these issues. As well, Python packages on Mandriva Linux 2007.1 and 2008.0 have been updated to version 2.5.2. Due to slight packaging changes on Mandriva Linux 2007.1, a new package is available (tkinter-apps) that contains binary files (such as /usr/bin/idle) that were previously in the tkinter package.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-001 applied.

This security update contains fixes for the following products :

  - AFP Server
  - Apple Pixlet Video
  - CarbonCore
  - CFNetwork
  - Certificate Assistant
  - ClamAV
  - CoreText
  - CUPS
  - DS Tools
  - fetchmail
  - Folder Manager
  - FSEvents
  - Network Time
  - perl
  - Printing
  - python
  - Remote Apple Events
  - Safari RSS
  - servermgrd
  - SMB
  - SquirrelMail
  - X11
  - XTerm

This update of python fixes several security vulnerabilities.
(CVE-2008-1679 / CVE-2008-1887 / CVE-2008-3143 / CVE-2008-3142 / CVE-2008-3144 / CVE-2008-2315 / CVE-2008-2316) Note: for SLE10 a non-security bug in mmap was fixed too.

New python packages are available for Slackware 10.1, 10.2, 11.0, 12.0, 12.1, and -current to fix security issues.

It was discovered that there were new integer overflows in the imageop module. If an attacker were able to trick a Python application into processing a specially crafted image, they could execute arbitrary code with user privileges. (CVE-2008-1679)

Justin Ferguson discovered that the zlib module did not correctly handle certain archives. If an attacker were able to trick a Python application into processing a specially crafted archive file, they could execute arbitrary code with user privileges. (CVE-2008-1721)

Justin Ferguson discovered that certain string manipulations in Python could be made to overflow. If an attacker were able to pass a specially crafted string through the PyString_FromStringAndSize function, they could execute arbitrary code with user privileges.
(CVE-2008-1887)

Multiple integer overflows were discovered in Python's core and modules including hashlib, binascii, pickle, md5, stringobject, unicodeobject, bufferobject, longobject, tupleobject, stropmodule, gcmodule, and mmapmodule. If an attacker were able to exploit these flaws they could execute arbitrary code with user privileges or cause Python applications to crash, leading to a denial of service.
(CVE-2008-2315, CVE-2008-2316, CVE-2008-3142, CVE-2008-3143, CVE-2008-3144).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the interpreter for the Python language. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-2052     Piotr Engelking discovered that the strxfrm() function     of the locale module miscalculates the length of an     internal buffer, which may result in a minor information     disclosure.

  - CVE-2007-4965     It was discovered that several integer overflows in the     imageop module may lead to the execution of arbitrary     code, if a user is tricked into processing malformed     images. This issue is also tracked as CVE-2008-1679 due     to an initially incomplete patch.

  - CVE-2008-1721     Justin Ferguson discovered that a buffer overflow in the     zlib module may lead to the execution of arbitrary code.

  - CVE-2008-1887     Justin Ferguson discovered that insufficient input     validation in PyString_FromStringAndSize() may lead to     the execution of arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200807-01 (Python: Multiple integer overflows)

    Multiple vulnerabilities were discovered in Python:
    David     Remahl reported multiple integer overflows in the file imageop.c,     leading to a heap-based buffer overflow (CVE-2008-1679). This issue is     due to an incomplete fix for CVE-2007-4965.
    Justin Ferguson     discovered that an integer signedness error in the zlib extension     module might trigger insufficient memory allocation and a buffer     overflow via a negative signed integer (CVE-2008-1721).
    Justin     Ferguson discovered that insufficient input validation in the     PyString_FromStringAndSize() function might lead to a buffer overflow     (CVE-2008-1887).
  Impact :

    A remote attacker could exploit these vulnerabilities to cause a Denial     of Service or possibly the remote execution of arbitrary code with the     privileges of the user running Python.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
67898	Oracle Linux 3 : python (ELSA-2009-1178)	Nessus	Oracle Linux Local Security Checks	critical
67897	Oracle Linux 4 : python (ELSA-2009-1177)	Nessus	Oracle Linux Local Security Checks	critical
60625	Scientific Linux Security Update : python for SL 4.x on i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
60624	Scientific Linux Security Update : python for SL 3.0.x on i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
41229	SuSE9 Security Update : Python (YOU Patch Number 12215)	Nessus	SuSE Local Security Checks	high
40402	RHEL 3 : python (RHSA-2009:1178)	Nessus	Red Hat Local Security Checks	critical
40401	RHEL 4 : python (RHSA-2009:1177)	Nessus	Red Hat Local Security Checks	critical
40394	CentOS 3 : python (CESA-2009:1178)	Nessus	CentOS Local Security Checks	critical
40115	openSUSE Security Update : python (python-128)	Nessus	SuSE Local Security Checks	high
37212	Mandriva Linux Security Advisory : python (MDVSA-2008:163)	Nessus	Mandriva Local Security Checks	critical
35684	Mac OS X Multiple Vulnerabilities (Security Update 2009-001)	Nessus	MacOS X Local Security Checks	critical
33924	openSUSE 10 Security Update : python (python-5491)	Nessus	SuSE Local Security Checks	high
33923	SuSE 10 Security Update : Python (ZYPP Patch Number 5490)	Nessus	SuSE Local Security Checks	high
33824	Slackware 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / current : python (SSA:2008-217-01)	Nessus	Slackware Local Security Checks	high
33807	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : python2.4, python2.5 vulnerabilities (USN-632-1)	Nessus	Ubuntu Local Security Checks	critical
33740	Debian DSA-1620-1 : python2.5 - several vulnerabilities	Nessus	Debian Local Security Checks	high
33421	GLSA-200807-01 : Python: Multiple integer overflows	Nessus	Gentoo Local Security Checks	high
32006	Debian DSA-1551-1 : python2.4 - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2008-1679

critical

Tenable Plugins

critical

critical

critical

critical

high

critical

critical

critical

high

critical

critical

high

high

high

critical

high

high

high