vendor:
Python
by:
Chris Evans
7.5
CVSS
HIGH
Buffer-Overflow
120
CWE
Product Name: Python
Affected Version From: Python 2.4.3
Affected Version To: Python 2.5.1
Patch Exists: YES
Related CWE: CVE-2008-4864
CPE: a:python:python:2.5.1
Metasploit:
https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2009-1178/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2009-1176/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2009-1177/, https://www.rapid7.com/db/vulnerabilities/vmsa-2009-0016-5-updated-service-console-package-python-cve-2008-4864/, https://www.rapid7.com/db/vulnerabilities/apple-osx-python-cve-2008-4864/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2008-4864/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2008-4864/
Other Scripts:
https://www.infosecmatter.com/nessus-plugin-library/?id=35684, https://www.infosecmatter.com/nessus-plugin-library/?id=40401, https://www.infosecmatter.com/nessus-plugin-library/?id=41260, https://www.infosecmatter.com/nessus-plugin-library/?id=41581, https://www.infosecmatter.com/nessus-plugin-library/?id=40400, https://www.infosecmatter.com/nessus-plugin-library/?id=60625, https://www.infosecmatter.com/nessus-plugin-library/?id=60622, https://www.infosecmatter.com/nessus-plugin-library/?id=67897, https://www.infosecmatter.com/nessus-plugin-library/?id=40394, https://www.infosecmatter.com/nessus-plugin-library/?id=67898
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: VMWare vMA 4.0, VMWare ESX Server 3.0.3, VMWare ESX Server 2.5.5, VMWare ESX Server 4.0, VMWare ESX Server 3.5, Ubuntu Ubuntu Linux 8.10 sparc, Ubuntu Ubuntu Linux 8.10 powerpc, Ubuntu Ubuntu Linux 8.10 lpia, Ubuntu Ubuntu Linux 8.10 i386, Ubuntu Ubuntu Linux 8.10 amd64, Ubuntu Ubuntu Linux 8.04 LTS sparc, Ubuntu Ubuntu Linux 8.04 LTS powerpc, Ubuntu Ubuntu Linux 8.04 LTS lpia, Ubuntu Ubuntu Linux 8.04 LTS i386, Ubuntu Ubuntu Linux 8.04 LTS amd64, Ubuntu Ubuntu Linux 6.06 LTS sparc, Ubuntu Ubuntu Linux 6.06 LTS powerpc, Ubuntu Ubuntu Linux 6.06 LTS i386, Ubuntu Ubuntu Linux 6.06 LTS amd64, S.u.S.E. SUSE Linux Enterprise Server 10 SP2, S.u.S.E. SUSE Linux Enterprise Desktop 10 SP2, S.u.S.E. SLE SDK 10 SP2, S.u.S.E. openSUSE 11.1, S.u.S.E. openSUSE 11.0, S.u.S.E. openSUSE 10.3, S.u.S.E. Open-Enterprise-Server 0, S.u.S.E. Novell Linux POS 9, S.u.S.E. Novell Linux Desktop 9, RedHat Enterprise Linux WS 4, RedHat Enterprise Linux WS 3, RedHat Enterprise Linux ES 4, RedHat Enterprise Linux ES 3, RedHat Enterprise Linux Desktop Workstation 5 client, RedHat Enterprise Linux Desktop 5 client, RedHat Enterprise Linux AS 4, RedHat Enterprise Linux AS 3, RedHat Enterprise Linux Desktop version 4, RedHat Enterprise Linux 5 server, RedHat Desktop 3.0, Python Software Foundation Python 2.5.1, Python Software Foundation Python 2.4.5, Python Software Foundation Python 2.4.4 r14, Python Software Foundation Python 2.4.4, Python Software Foundation Python 2.4.3, Trustix Secure Linux 3.0.5, Pythian Linux 2.6.9
2008
Python’s ‘imageop’ module Buffer-Overflow Vulnerability
Python's 'imageop' module is prone to a buffer-overflow vulnerability. Successful exploits may allow attackers to execute arbitrary code in the context of applications using the vulnerable Python module. This may result in a compromise of the underlying system. Failed attempts may lead to a denial-of-service condition.
Mitigation:
Upgrade to Python 2.5.2 or later.
