Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.

According to the versions of the python-crypto package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Heap-based buffer overflow in the ALGnew function in     block_templace.c in Python Cryptography Toolkit (aka     pycrypto) allows remote attackers to execute arbitrary     code as demonstrated by a crafted iv parameter to     cryptmsg.py.(CVE-2013-7459)

  - lib/Crypto/PublicKey/ElGamal.py in PyCrypto through     2.6.1 generates weak ElGamal key parameters, which     allows attackers to obtain sensitive information by     reading ciphertext data (i.e., it does not have     semantic security in face of a ciphertext-only attack).
    The Decisional Diffie-Hellman (DDH) assumption does not     hold for PyCrypto's ElGamal     implementation.(CVE-2018-6594)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the python-crypto package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Heap-based buffer overflow in the ALGnew function in     block_templace.c in Python Cryptography Toolkit (aka     pycrypto) allows remote attackers to execute arbitrary     code as demonstrated by a crafted iv parameter to     cryptmsg.py.(CVE-2013-7459)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the pycrypto package has been released.

An update of the openjre package has been released.

An update of the openjdk package has been released.

This update for python-pycrypto fixes the following issues :

  - CVE-2013-7459: Fixed a potential heap buffer overflow in     ALGnew (bsc#1017420). python-paramiko was adjusted to     work together with this python-pycrypto change.
    (bsc#1047666)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-3199-1 fixed a vulnerability in Python Crypto. This update provides the corresponding update for Ubuntu 12.04 ESM.

It was discovered that the ALGnew function in block_templace.c in the Python Cryptography Toolkit contained a heap-based buffer overflow vulnerability. A remote attacker could use this flaw to execute arbitrary code by using a crafted initialization vector parameter.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python-pycrypto fixes the following issues :

  - CVE-2013-7459: Fixed a potential heap buffer overflow in     ALGnew (bsc#1017420).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A heap-buffer overflow vulnerability was discovered in cryptopp. This vulnerability can be used to remotely gain access to shell.

USN-3199-1 fixed a vulnerability in the Python Cryptography Toolkit.
Unfortunately, various programs depended on the original behavior of the Python Cryptography Toolkit which was altered when fixing the vulnerability. This update retains the fix for the vulnerability but issues a warning rather than throwing an exception. Code which produces this warning should be updated because future versions of the Python Cryptography Toolkit re-introduce the exception.

We apologize for the inconvenience.

It was discovered that the ALGnew function in block_template.c in the Python Cryptography Toolkit contained a heap-based buffer overflow vulnerability. A remote attacker could use this flaw to execute arbitrary code by using a crafted initialization vector parameter.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201702-14 (PyCrypto: Remote execution of arbitrary code)

    A heap-based buffer overflow vulnerability has been discovered in       PyCrypto. Please review the CVE identifier referenced below for details.
  Impact :

    A remote attacker, able to control the mode of operation in PyCrypto&rsquo;s       AES module, could possibly execute arbitrary code with the privileges of       the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

It was discovered that the ALGnew function in block_templace.c in the Python Cryptography Toolkit contained a heap-based buffer overflow vulnerability. A remote attacker could use this flaw to execute arbitrary code by using a crafted initialization vector parameter.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A heap-buffer overflow vulnerability was discovered in pycrypto leading to arbitrary code execution. All users of pycrypto's AES module that allow the mode of operation to be specified by an attacker, check for ECB explicitly and create the objects without specifying an IV are vulnerable to this issue.

This is CVE-2013-7459.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python-pycrypto fixes the following issues :

  - A heap buffer overflow in the AES module was fixed that     could have lead to remote code execution, if the mode of     operation can be specified from the outside     (CVE-2013-7459, boo#1017420).

ID	Name	Product	Family	Severity
140944	EulerOS Virtualization for ARM 64 3.0.6.0 : python-crypto (EulerOS-SA-2020-1996)	Nessus	Huawei Local Security Checks	critical
131664	EulerOS 2.0 SP2 : python-crypto (EulerOS-SA-2019-2511)	Nessus	Huawei Local Security Checks	critical
121720	Photon OS 1.0: Pycrypto PHSA-2017-0026	Nessus	PhotonOS Local Security Checks	critical
121719	Photon OS 1.0: Openjre PHSA-2017-0026	Nessus	PhotonOS Local Security Checks	critical
121718	Photon OS 1.0: Openjdk PHSA-2017-0026	Nessus	PhotonOS Local Security Checks	critical
120005	SUSE SLES12 Security Update : python-pycrypto (SUSE-SU-2017:2350-1)	Nessus	SuSE Local Security Checks	critical
110744	EulerOS 2.0 SP3 : python-crypto (EulerOS-SA-2018-1168)	Nessus	Huawei Local Security Checks	critical
102814	Ubuntu 12.04 LTS : python-crypto vulnerability (USN-3199-3)	Nessus	Ubuntu Local Security Checks	critical
101259	SUSE SLES11 Security Update : python-pycrypto (SUSE-SU-2017:1744-1)	Nessus	SuSE Local Security Checks	critical
97553	Amazon Linux AMI : python-crypto (ALAS-2017-801)	Nessus	Amazon Linux Local Security Checks	critical
97301	Ubuntu 14.04 LTS / 16.04 LTS : Python Crypto regression (USN-3199-2)	Nessus	Ubuntu Local Security Checks	critical
97257	GLSA-201702-14 : PyCrypto: Remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
97221	Ubuntu 14.04 LTS / 16.04 LTS : Python Crypto vulnerability (USN-3199-1)	Nessus	Ubuntu Local Security Checks	critical
96892	Fedora 25 : python-crypto (2017-7c569d396b)	Nessus	Fedora Local Security Checks	critical
96886	Fedora 24 : python-crypto (2017-08207fe48b)	Nessus	Fedora Local Security Checks	critical
96552	openSUSE Security Update : python-pycrypto (openSUSE-2017-86)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2013-7459

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical