Python PyLocale_strxfrm Function Remote Information Leak Vulnerability

Bugtraq ID:	23887
Class:	Boundary Condition Error
CVE:	CVE-2007-2052
Remote:	Yes
Local:	No
Published:	May 08 2007 12:00AM
Updated:	Mar 30 2010 06:22PM
Credit:	Piotr Engelking is credited with discovering this issue.
Vulnerable:	VMWare vMA 4.0 VMWare ESX Server 3.0.3 VMWare ESX Server 3.0.2 VMWare ESX Server 3.0.1 VMWare ESX Server 2.5.5 patch 4 VMWare ESX Server 2.5.5 VMWare ESX Server 2.5.4 patch 15 VMWare ESX Server 4.0 VMWare ESX Server 3.5 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 rPath rPath Linux 1 Redhat Red Hat Network Satellite Server 5.0 Redhat Red Hat Network Satellite Server 4.2 Redhat Network Satellite (for RHEL 4) 5.1 Redhat Network Satellite (for RHEL 4) 4.2 Redhat Network Satellite (for RHEL 3) 4.2 Redhat Fedora Core6 Redhat Fedora Core5 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux WS 2.1 IA64 Redhat Enterprise Linux WS 2.1 Redhat Enterprise Linux ES 4.6.z Redhat Enterprise Linux ES 4.5.z Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux ES 2.1 IA64 Redhat Enterprise Linux ES 2.1 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux AS 4.6.z Redhat Enterprise Linux AS 4.5.z Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux AS 2.1 IA64 Redhat Enterprise Linux AS 2.1 Redhat Enterprise Linux 5 Server Redhat Desktop 4.0 Redhat Desktop 3.0 Redhat Advanced Workstation for the Itanium Processor 2.1 IA64 Redhat Advanced Workstation for the Itanium Processor 2.1 Python Software Foundation Python 2.4.4 Python Software Foundation Python 2.4.3 + Trustix Secure Linux 3.0.5 Python Software Foundation Python 2.5 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Foresight Linux Foresight Linux 1.1 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Avaya Messaging Storage Server Avaya Message Networking Avaya Intuity AUDIX LX 2.0
Not Vulnerable:	VMWare vMA 4.0 Patch 2

Python PyLocale_strxfrm Function Remote Information Leak Vulnerability

Python applications that use the 'PyLocale_strxfrm' function are prone to an information leak.

Exploiting this issue allows remote attackers to read portions of memory.

Python 2.4.4-2 and 2.5 are confirmed vulnerable.

Python PyLocale_strxfrm Function Remote Information Leak Vulnerability

The following proof-of-concept exploit is available.

• /data/vulnerabilities/exploits/python-strxfrm-ob1.py

Python PyLocale_strxfrm Function Remote Information Leak Vulnerability

Solution:
Specific GNU/Linux vendors have released updated Python interpreters. Please see the referenced advisories for more information.


Mandriva Linux Mandrake 2007.1

• Mandriva Mandriva Linux 2007.1 python-2.5-4.1mdv2007.1.i586.rpm
  2007.1/i586/python-2.5-4.1mdv2007.1.i586.rpm

Mandriva Linux Mandrake 2007.1 x86_64

• Mandriva Mandriva Linux 2007.1/X86_64 python-2.5-4.1mdv2007.1.x86_64.rpm
  2007.1/x86_64/python-2.5-4.1mdv2007.1.x86_64.rpm


• Mandriva Mandriva Linux 2007/X86_64 python-2.4.3-3.2mdv2007.0.x86_64.rpm
  2007.0/x86_64/python-2.4.3-3.2mdv2007.0.x86_64.rpm

VMWare ESX Server 4.0

• VMWare ESX-4.0.0-update01.zip
  https://hostupdate.vmware.com/software/VUM/OFFLINE/release-158-2009111 8-187517/ESX-4.0.0-update01.zip

VMWare ESX Server 3.5

• VMWare ESX350-201002402-SG.zip
  http://download3.vmware.com/software/vi/ESX350-201002402-SG.zip

Mandriva Linux Mandrake 2007.0

• Mandriva Mandriva Linux 2007 python-2.4.3-3.2mdv2007.0.i586.rpm
  2007.0/i586/python-2.4.3-3.2mdv2007.0.i586.rpm

MandrakeSoft Corporate Server 4.0

• Mandriva Corporate Server 4.0 python-2.4.1-5.2.20060mlcs4.i586.rpm
  corporate/4.0/i586/python-2.4.1-5.2.20060mlcs4.i586.rpm

MandrakeSoft Multi Network Firewall 2.0

• Mandriva Multi Network Firewall 2.0 python-2.3.3-2.4.M20mdk.i586.rpm
  mnf/2.0/i586/python-2.3.3-2.4.M20mdk.i586.rpm

MandrakeSoft Corporate Server 3.0

• Mandriva Corporate Server 3.0 python-2.3.3-2.4.C30mdk.i586.rpm
  corporate/3.0/i586/python-2.3.3-2.4.C30mdk.i586.rpm


• Mandriva Corporate Server 3.0/X86_64 python-2.3.3-2.4.C30mdk.x86_64.rpm
  corporate/3.0/x86_64/python-2.3.3-2.4.C30mdk.x86_64.rpm

MandrakeSoft Corporate Server 3.0 x86_64

• Mandriva Corporate Server 3.0 python-2.3.3-2.4.C30mdk.i586.rpm
  corporate/3.0/i586/python-2.3.3-2.4.C30mdk.i586.rpm


• Mandriva Corporate Server 3.0/X86_64 python-2.3.3-2.4.C30mdk.x86_64.rpm
  corporate/3.0/x86_64/python-2.3.3-2.4.C30mdk.x86_64.rpm

VMWare ESX Server 3.0.3

• VMWare ESX303-201002206-UG.zip
  http://download3.vmware.com/software/vi/ESX303-201002206-UG.zip

MandrakeSoft Corporate Server 4.0 x86_64

• Mandriva Corporate Server 4.0/X86_64 python-2.4.1-5.2.20060mlcs4.x86_64.rpm
  corporate/4.0/x86_64/python-2.4.1-5.2.20060mlcs4.x86_64.rpm

Python PyLocale_strxfrm Function Remote Information Leak Vulnerability

References:

• Bugzilla Bug 235093: CVE-2007-2052 Off-by-one in python's locale.strxfrm() (Redhat)
  
• Python Homepage (Python Software Foundation)
  
• python2.5: off-by-one bug in strxfrm() (causes information leak) (Debian)
  
• VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release addre (VMware Security Team )
  
• ASA-2008-017 - python security update (RHSA-2007-1077) (Avaya)
  
• RHSA-2007:1076-6 python security update (Red Hat)
  
• RHSA-2007:1077-5 python security update (Red Hat)
  
• RHSA-2008:0264-3 Moderate: Red Hat Network Satellite Server Solaris client secur (Red Hat)
  
• RHSA-2008:0525-5 Red Hat Network Satellite Server Solaris client security update (Red Hat)
  
• RHSA-2008:0629-3 Moderate: Red Hat Network Satellite Server Solaris client secur (Red Hat)
  
• VMware ESX Server 3.5, Patch ESX350-200802408-SG: Security Updates to the Python (VMware)