Mandriva Linux Security Advisory : python (MDVSA-2015:075)

high Nessus Plugin ID 82328
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

Updated python packages fix security vulnerabilities :

A vulnerability was reported in Python's socket module, due to a boundary error within the sock_recvfrom_into() function, which could be exploited to cause a buffer overflow. This could be used to crash a Python application that uses the socket.recvfrom_info() function or, possibly, execute arbitrary code with the permissions of the user running vulnerable Python code (CVE-2014-1912).

This updates the python package to version 2.7.6, which fixes several other bugs, including denial of service flaws due to unbound readline() calls in the ftplib and nntplib modules (CVE-2013-1752).

Denial of service flaws due to unbound readline() calls in the imaplib, poplib, and smtplib modules (CVE-2013-1752).

A gzip bomb and unbound read denial of service flaw in python XMLRPC library (CVE-2013-1753).

Python are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the _json module caused by insufficient bounds checking. The bug is caused by allowing the user to supply a negative value that is used an an array index, causing the scanstring function to access process memory outside of the string it is intended to access (CVE-2014-4616).

The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute arbitrary scripts in the server's document root (CVE-2014-4650).

Python before 2.7.8 is vulnerable to an integer overflow in the buffer type (CVE-2014-7185).

When Python's standard library HTTP clients (httplib, urllib, urllib2, xmlrpclib) are used to access resources with HTTPS, by default the certificate is not checked against any trust store, nor is the hostname in the certificate checked against the requested host. It was possible to configure a trust root to be checked against, however there were no faculties for hostname checking (CVE-2014-9365).

The python-pip and tix packages was added due to missing build dependencies.

Solution

Update the affected packages.

See Also

http://advisories.mageia.org/MGASA-2014-0085.html

http://advisories.mageia.org/MGASA-2014-0139.html

http://advisories.mageia.org/MGASA-2014-0285.html

http://advisories.mageia.org/MGASA-2014-0399.html

Plugin Details

Severity: High

ID: 82328

File Name: mandriva_MDVSA-2015-075.nasl

Version: 1.6

Type: local

Published: 3/30/2015

Updated: 1/6/2021

Dependencies: ssh_get_info.nasl

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:lib64python-devel, p-cpe:/a:mandriva:linux:lib64python2.7, p-cpe:/a:mandriva:linux:python, p-cpe:/a:mandriva:linux:python-docs, p-cpe:/a:mandriva:linux:python-pip, p-cpe:/a:mandriva:linux:python3-pip, p-cpe:/a:mandriva:linux:tix, p-cpe:/a:mandriva:linux:tix-devel, p-cpe:/a:mandriva:linux:tkinter, p-cpe:/a:mandriva:linux:tkinter-apps, cpe:/o:mandriva:business_server:2

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/27/2015

Reference Information

CVE: CVE-2013-1752, CVE-2013-1753, CVE-2014-1912, CVE-2014-4616, CVE-2014-4650, CVE-2014-7185, CVE-2014-9365

MDVSA: 2015:075