Python repr() function buffer overflow
| python-repr-bo (29408) |  High Risk |
Description:
Python is vulnerable to a buffer overflow, caused by improper bounds checking by the repr() function. By sending a specially-crafted UTF32/UCS-4 encoded string, a remote attacker could overflow a buffer and execute arbitrary code with the privileges of the application using the Python repr() function.
Platforms Affected:
- Canonical, Ubuntu 5.04
- Canonical, Ubuntu 5.10
- Canonical, Ubuntu 6.06 LTS
- Debian, Debian Linux 3.1
- Gentoo, Linux
- MandrakeSoft, Mandrake Linux 2006
- MandrakeSoft, Mandrake Linux 2006 X86_64
- MandrakeSoft, Mandrake Linux 2007 X86_64
- MandrakeSoft, Mandrake Linux 2007
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 4.0
- MandrakeSoft, Mandrake Multi Network Firewall 2.0
- Python Software Foundation, Python 2.3 - 2.6
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 4 AS
- RedHat, Enterprise Linux 4 WS
- RedHat, Network Satellite Server 4.2
- RedHat, Network Satellite Server 5.0
- RedHat, Network Satellite Server 5.1
Remedy:
Upgrade to the latest version of Python, available from the Python Web site. See References.
For Ubuntu Linux:
Refer to USN-359-1 for patch, upgrade, or suggested workaround information. See References.
For Red Hat Linux:
Refer to RHSA-2006:0713-6 for patch, upgrade, or suggested workaround information. See References.
For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 200610-07 for patch, upgrade, or suggested workaround information. See References.
For SUSE Linux:
Refer to SUSE Security Summary Report SUSE-SR:2006:025 for patch, upgrade, or suggested workaround information. See References.
For Debian GNU/Linux (Python 2.4):
Refer to DSA-1197-1 for patch, upgrade, or suggested workaround information. See References.
For Debian GNU/Linux (Python 2.3):
Refer to DSA-1198-1 for patch, upgrade, or suggested workaround information. See References.
For VMware:
Refer to Full-Disclosure Mailing List, Tue Jan 9 02:17:36 GMT 2007 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Access
References:
- Full-Disclosure Mailing List, Mon Jan 08 2007 - 20:17:36 CST, VMware ESX server security updates at http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0170.html.
- Python Web site, Python Language Website at http://www.python.org.
- SourceForge.net: Detail, [ 1541585 ] buffer overrun in repr() for unicode strings at http://sourceforge.net/tracker/index.php?func=detail&aid=1541585&group_id=5470&atid=305470.
- ASA-2006-229: python security update (RHSA-2006-0713)
- BID-20376: Python Repr() Function Remote Code Execution Vulnerability
- CVE-2006-4980: Buffer overflow in the repr function in Python 2.3 through 2.6 before 20060822 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via crafted wide character UTF-32/UCS-4 strings to certain scripts.
- DSA-1197: python2.4 -- buffer overflow
- DSA-1198: python2.3 -- buffer overflow
- FrSIRT/ADV-2006-3940: Python repr() Function Unicode String Handling Buffer Overflow Vulnerability
- FrSIRT/ADV-2006-5131: VMware ESX Server Python repr() Buffer Overflow and Denial of Service Vulnerability
- GLSA-200610-07: Python: Buffer Overflow
- MDKSA-2006:181: Updated python packages fix vulnerability
- RHSA-2006-0713: python security update
- RHSA-2008-0264: Moderate: Red Hat Network Satellite Server Solaris client security update
- RHSA-2008-0525: Moderate: Red Hat Network Satellite Server Solaris client security update
- RHSA-2008-0629: Moderate: Red Hat Network Satellite Server Solaris client security update
- SA22276: Python "repr()" Unicode String Buffer Overflow Vulnerability
- SA22379: Avaya Python "repr()" Unicode String Buffer Overflow Vulnerability
- SA23680: VMWare ESX Server Multiple Vulnerabilities
- SECTRACK ID: 1017019: Python repr() Processing of UTF-32/UCS-4 Strings May Let Remote Users Deny Service or Execute Arbitrary Code
- SUSE-SR:2006:025: SUSE Security Summary Report
- USN-359-1: Python vulnerability
Reported:
Oct 07, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net