Mandriva Linux Security Advisory : python (MDVSA-2012:097)

Medium Nessus Plugin ID 61956


The remote Mandriva Linux host is missing one or more security updates.


Multiple vulnerabilities has been discovered and corrected in python :

The _ssl module would always disable the CBC IV attack countermeasure (CVE-2011-3389).

A race condition was found in the way the Python distutils module set file permissions during the creation of the .pypirc file. If a local user had access to the home directory of another user who is running distutils, they could use this flaw to gain access to that user's .pypirc file, which can contain usernames and passwords for code repositories (CVE-2011-4944).

A flaw was found in the way the Python SimpleXMLRPCServer module handled clients disconnecting prematurely. A remote attacker could use this flaw to cause excessive CPU consumption on a server using SimpleXMLRPCServer (CVE-2012-0845).

Hash table collisions CPU usage DoS for the embedded copy of expat (CVE-2012-0876).

A denial of service flaw was found in the implementation of associative arrays (dictionaries) in Python. An attacker able to supply a large number of inputs to a Python application (such as HTTP POST request parameters sent to a web application) that are used as keys when inserting data into an array could trigger multiple hash function collisions, making array operations take an excessive amount of CPU time. To mitigate this issue, randomization has been added to the hash function to reduce the chance of an attacker successfully causing intentional collisions (CVE-2012-1150).

The updated packages have been patched to correct these issues.


Update the affected packages.

Plugin Details

Severity: Medium

ID: 61956

File Name: mandriva_MDVSA-2012-097.nasl

Version: $Revision: 1.9 $

Type: local

Published: 2012/09/06

Modified: 2016/03/14

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:lib64python-devel, p-cpe:/a:mandriva:linux:lib64python2.7, p-cpe:/a:mandriva:linux:libpython-devel, p-cpe:/a:mandriva:linux:libpython2.7, p-cpe:/a:mandriva:linux:python, p-cpe:/a:mandriva:linux:python-docs, p-cpe:/a:mandriva:linux:tkinter, p-cpe:/a:mandriva:linux:tkinter-apps, cpe:/o:mandriva:linux:2011

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2012/06/20

Reference Information

CVE: CVE-2011-3389, CVE-2011-4944, CVE-2012-0845, CVE-2012-0876, CVE-2012-1150

BID: 49778, 51239, 51996, 52379, 52732

OSVDB: 74829, 79249, 80009, 80892, 82462

MDVSA: 2012:097