Buffer overflow in the repr function in Python 2.3 through 2.6 before 20060822 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via crafted wide character UTF-32/UCS-4 strings to certain scripts.

Buffer overflow in the repr function in Python 2.3 through 2.6 before 20060822 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via crafted wide character UTF-32/UCS-4 strings to certain scripts. (CVE-2006-4980)

Impact

An attacker may be able to cause a denial-of-service (DoS) to the system or execute malicious code through exploited scripts.

From Red Hat Security Advisory 2006:0713 :

Updated Python packages are now available to correct a security issue in Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Python is an interpreted, interactive, object-oriented programming language.

A flaw was discovered in the way that the Python repr() function handled UTF-32/UCS-4 strings. If an application written in Python used the repr() function on untrusted data, this could lead to a denial of service or possibly allow the execution of arbitrary code with the privileges of the Python application. (CVE-2006-4980)

In addition, this errata fixes a regression in the SimpleXMLRPCServer backport for Red Hat Enterprise Linux 3 that was introduced with RHSA-2005:109.

Users of Python should upgrade to these updated packages, which contain a backported patch to correct this issue.

Red Hat Network Satellite Server version 5.1.1 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server Solaris client components.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

This release corrects several security vulnerabilities in components shipped as part of the Red Hat Network Satellite Server Solaris client. In a typical operating environment, these components are not used by the Satellite Server in a vulnerable manner. These security updates will reduce risk should these components be used by other applications.

Several flaws in Zlib were discovered. An attacker could create a carefully-crafted compressed stream that would cause an application to crash if the stream was opened by a user. (CVE-2005-2096, CVE-2005-1849)

A buffer overflow was discovered in the OpenSSL SSL_get_shared_ciphers() utility function. An attacker could send a list of ciphers to an application that used this function and overrun a buffer (CVE-2006-3738).

A flaw in the SSLv2 client code was discovered. If a client application used OpenSSL to create an SSLv2 connection to a malicious server, that server could cause the client to crash. (CVE-2006-4343)

An attack on OpenSSL PKCS #1 v1.5 signatures was discovered. Where an RSA key with exponent 3 was used an attacker could, potentially, forge a PKCS #1 v1.5 signature that would be incorrectly verified by implementations that do not check for excess data in the RSA exponentiation result of the signature. This issue affected applications that use OpenSSL to verify X.509 certificates as well as other uses of PKCS #1 v1.5. (CVE-2006-4339)

OpenSSL contained a software work-around for a bug in SSL handling in Microsoft Internet Explorer version 3.0.2. It is enabled in most servers that use OpenSSL to provide support for SSL and TLS. This work-around was vulnerable to a man-in-the-middle attack which allowed a remote user to force an SSL connection to use SSL 2.0, rather than a stronger protocol, such as SSL 3.0 or TLS 1.0. (CVE-2005-2969)

During OpenSSL parsing of certain invalid ASN.1 structures, an error condition was mishandled. This could result in an infinite loop which consumed system memory (CVE-2006-2937).

Certain public key types could take disproportionate amounts of time to process in OpenSSL, leading to a denial of service. (CVE-2006-2940)

A flaw was discovered in the Python repr() function's handling of UTF-32/UCS-4 strings. If an application used the repr() function on untrusted data, this could lead to a denial of service or, possibly, allow the execution of arbitrary code with the privileges of the application using the flawed function. (CVE-2006-4980)

A flaw was discovered in the strxfrm() function of Python's locale module. Strings generated by this function were not properly NULL-terminated. This could, potentially, cause disclosure of data stored in the memory of an application using this function.
(CVE-2007-2052)

Multiple integer overflow flaws were discovered in Python's imageop module. If an application used the imageop module to process untrusted images, it could cause the application to crash, enter an infinite loop, or, possibly, execute arbitrary code with the privileges of the Python interpreter. (CVE-2007-4965)

A stack-based buffer overflow was discovered in the Python interpreter, which could allow a local user to gain privileges by running a script with a long name from the current working directory.
(CVE-2006-1542)

Users of Red Hat Network Satellite Server should upgrade to these updated packages, which contain backported patches to correct these issues.

Red Hat Network Satellite Server version 4.2.3 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server Solaris client components.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

This release corrects several security vulnerabilities in various components shipped as part of the Red Hat Network Satellite Server Solaris client. In a typical operating environment, these components are not used by the Satellite Server in a vulnerable manner. These security updates will reduce risk should these components be used by other applications.

Several flaws in Zlib was discovered. An attacker could create a carefully-crafted compressed stream that would cause an application to crash if the stream is opened by a user. (CVE-2005-2096). An attacker could create a carefully crafted compressed stream that would cause an application to crash if the stream is opened by a user.
(CVE-2005-1849)

A buffer overflow was discovered in the OpenSSL SSL_get_shared_ciphers() utility function. An attacker could send a list of ciphers to an application that used this function and overrun a buffer (CVE-2006-3738).

A flaw in the SSLv2 client code was discovered. If a client application used OpenSSL to create an SSLv2 connection to a malicious server, that server could cause the client to crash. (CVE-2006-4343)

An attack on OpenSSL PKCS #1 v1.5 signatures was discovered. Where an RSA key with exponent 3 is used it may be possible for an attacker to forge a PKCS #1 v1.5 signature that would be incorrectly verified by implementations that do not check for excess data in the RSA exponentiation result of the signature. This issue affected applications that use OpenSSL to verify X.509 certificates as well as other uses of PKCS #1 v1.5. (CVE-2006-4339)

OpenSSL contained a software work-around for a bug in SSL handling in Microsoft Internet Explorer version 3.0.2. It is enabled in most servers that use OpenSSL to provide support for SSL and TLS. This work-around could allow an attacker, acting as a 'man in the middle' to force an SSL connection to use SSL 2.0 rather than a stronger protocol, such as SSL 3.0 or TLS 1.0. (CVE-2005-2969)

During OpenSSL parsing of certain invalid ASN.1 structures an error condition was mishandled. This can result in an infinite loop which consumed system memory (CVE-2006-2937).

Certain public key types can take disproportionate amounts of time to process in OpenSSL, leading to a denial of service. (CVE-2006-2940)

A flaw was discovered in the way that the Python repr() function handled UTF-32/UCS-4 strings. If an application written in Python used the repr() function on untrusted data, this could lead to a denial of service or possibly allow the execution of arbitrary code with the privileges of the Python application. (CVE-2006-4980)

A flaw was discovered in the strxfrm() function of Python's locale module. Strings generated by this function were not properly NULL-terminated. This may possibly cause disclosure of data stored in the memory of a Python application using this function.
(CVE-2007-2052)

Multiple integer overflow flaws were discovered in Python's imageop module. If an application written in Python used the imageop module to process untrusted images, it could cause the application to crash, enter an infinite loop, or possibly execute arbitrary code with the privileges of the Python interpreter. (CVE-2007-4965)

A stack-based buffer overflow was discovered in the Python interpreter, which could allow a local user to gain privileges by running a script with a long name from the current working directory.
(CVE-2006-1542)

Users of Red Hat Network Satellite Server should upgrade to these updated packages, which contain backported patches to correct these issues.

Red Hat Network Satellite Server version 5.0.2 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server Solaris client components.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

This release corrects several security vulnerabilities in various components shipped as part of the Red Hat Network Satellite Server Solaris client. In a typical operating environment, these components are not used by the Satellite Server in a vulnerable manner. These security updates will reduce risk should these components be used by other applications.

Two denial-of-service flaws were fixed in ZLib. (CVE-2005-2096, CVE-2005-1849)

Multiple flaws were fixed in OpenSSL. (CVE-2006-4343, CVE-2006-4339, CVE-2006-3738, CVE-2006-2940, CVE-2006-2937, CVE-2005-2969)

Multiple flaws were fixed in Python. (CVE-2007-4965, CVE-2007-2052, CVE-2006-4980, CVE-2006-1542)

Users of Red Hat Network Satellite Server 5.0.1 are advised to upgrade to 5.0.2, which resolves these issues.

A buffer overflow within python's repr() function has been fixed. The CAN number CVE-2006-4980 has been assigned to this issue.

Benjamin C. Wiley Sittler discovered that Python's repr() function did not properly handle UTF-32/UCS-4 strings. If an application uses repr() on arbitrary untrusted data, this could be exploited to execute arbitrary code with the privileges of the python application.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability in python's repr() function was discovered by Benjamin C. Wiley Sittler. It was found that the function did not properly handle UTF-32/UCS-4 strings, so an application that used repr() on certin untrusted data could possibly be exploited to execute arbitrary code with the privileges of the user running the python application.

Updated packages have been patched to correct this issue.

Benjamin C. Wiley Sittler discovered that the repr() of the Python interpreter allocates insufficient memory when parsing UCS-4 Unicode strings, which might lead to execution of arbitrary code through a buffer overflow.

The remote host is affected by the vulnerability described in GLSA-200610-07 (Python: Buffer Overflow)

    Benjamin C. Wiley Sittler discovered a buffer overflow in Python's     'repr()' function when handling UTF-32/UCS-4 encoded strings.
  Impact :

    If a Python application processes attacker-supplied data with the     'repr()' function, this could potentially lead to the execution of     arbitrary code with the privileges of the affected application or a     Denial of Service.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2006:0713 advisory.

  - python repr unicode buffer overflow (CVE-2006-4980)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Benjamin C. Wiley Sittler reports :

I discovered a [buffer overrun in repr() for unicode strings]. This causes an unpatched non-debug wide (UTF-32/UCS-4) build of python to abort.

Ubuntu security team reports :

If an application uses repr() on arbitrary untrusted data, this [bug] could be exploited to execute arbitrary code with the privileges of the python application.

Updated Python packages are now available to correct a security issue in Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Python is an interpreted, interactive, object-oriented programming language.

A flaw was discovered in the way that the Python repr() function handled UTF-32/UCS-4 strings. If an application written in Python used the repr() function on untrusted data, this could lead to a denial of service or possibly allow the execution of arbitrary code with the privileges of the Python application. (CVE-2006-4980)

In addition, this errata fixes a regression in the SimpleXMLRPCServer backport for Red Hat Enterprise Linux 3 that was introduced with RHSA-2005:109.

Users of Python should upgrade to these updated packages, which contain a backported patch to correct this issue.

ID	Name	Product	Family	Severity
82673	F5 Networks BIG-IP : Python vulnerability (K16398)	Nessus	F5 Networks Local Security Checks	high
67414	Oracle Linux 3 / 4 : python (ELSA-2006-0713)	Nessus	Oracle Linux Local Security Checks	high
43839	RHEL 4 : Solaris client in Satellite Server (RHSA-2008:0629)	Nessus	Red Hat Local Security Checks	critical
43838	RHEL 3 / 4 : Solaris client in Satellite Server (RHSA-2008:0525)	Nessus	Red Hat Local Security Checks	critical
43836	RHEL 4 : Solaris client in Satellite Server (RHSA-2008:0264)	Nessus	Red Hat Local Security Checks	critical
29559	SuSE 10 Security Update : Python (ZYPP Patch Number 2167)	Nessus	SuSE Local Security Checks	high
27939	Ubuntu 5.04 / 5.10 / 6.06 LTS : python2.3, python2.4 vulnerability (USN-359-1)	Nessus	Ubuntu Local Security Checks	high
27406	openSUSE 10 Security Update : python (python-2168)	Nessus	SuSE Local Security Checks	high
24566	Mandrake Linux Security Advisory : python (MDKSA-2006:181)	Nessus	Mandriva Local Security Checks	high
22907	Debian DSA-1198-1 : python2.3 - buffer overflow	Nessus	Debian Local Security Checks	high
22906	Debian DSA-1197-1 : python2.4 - buffer overflow	Nessus	Debian Local Security Checks	high
22893	GLSA-200610-07 : Python: Buffer Overflow	Nessus	Gentoo Local Security Checks	high
22525	RHEL 4 : python (RHSA-2006:0713)	Nessus	Red Hat Local Security Checks	critical
22521	FreeBSD : python -- buffer overrun in repr() for unicode strings (fe83eb5b-55e1-11db-a5ae-00508d6a62df)	Nessus	FreeBSD Local Security Checks	high
22514	CentOS 3 / 4 : python (CESA-2006:0713)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2006-4980

critical

Tenable Plugins

high

high

critical

critical

critical

high

high

high

high

high

high

high

critical

high

high