Bug 485298 (CVE-2009-0544)

Summary: CVE-2009-0544 python-crypto: buffer overflow in the ARC2 module
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: fedora
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0544
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-02-15 10:40:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 485300, 485301, 485302    
Bug Blocks:    
Attachments:
Description Flags
testcase none

Description Vincent Danen 2009-02-12 19:03:08 UTC 
Name: CVE-2009-0544
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0544
Assigned: 20090212
Reference: MLIST:[oss-security] 20090207 CVE Request: pycrypto
Reference: URL: http://www.openwall.com/lists/oss-security/2009/02/07/1
Reference: MLIST:[oss-security] 20090212 Re: CVE Request: pycrypto
Reference: URL: http://www.openwall.com/lists/oss-security/2009/02/12/5
Reference: CONFIRM: http://gitweb2.dlitz.net/?p=crypto/pycrypto-2.x.git;a=commitdiff;h=d1c4875e1f220652fe7ff8358f56dee3b2aba31b
Reference: CONFIRM: http://gitweb2.dlitz.net/?p=crypto/pycrypto-2.x.git;a=commitdiff;h=fd73731dfad451a81056fbb01e09aa78ab82eb5d
Reference: BID:33674
Reference: URL: http://www.securityfocus.com/bid/33674
Reference: XF:pycrypto-arc2module-bo(48617)
Reference: URL: http://xforce.iss.net/xforce/xfdb/48617

Buffer overflow in the PyCrypto ARC2 module 2.0.1 allows remote
attackers to cause a denial of service and possibly execute arbitrary
code via a large ARC2 key length.


The patch is here:

http://gitweb2.dlitz.net/?p=crypto/pycrypto-2.x.git;a=commitdiff;h=d1c4875e1f220652fe7ff8358f56dee3b2aba31b
Comment 2 Vincent Danen 2009-02-12 19:08:17 UTC 
Created attachment 331731 [details]
testcase

Originally taken from http://downloads.securityfocus.com/vulnerabilities/exploits/SelfTest_Cipher_test_ARC2.py