Red Hat Bugzilla – Bug 1345856
CVE-2016-5636 python: Heap overflow in zipimporter module
Last modified: 2018-08-27 17:30:31 EDT
A heap-based buffer overflow vulnerability was found in zipimporter module. Vulnerable code: 1116 bytes_size = compress == 0 ? data_size : data_size + 1; 1117 if (bytes_size == 0) 1118 bytes_size++; 1119 raw_data = PyBytes_FromStringAndSize((char *)NULL, bytes_size); data_size is not sanitized, so if comepress != 0 and data_size = -1, then it overflows and becomes 0. Right after then it's incremented and becomes 1. In that case, python allocates small portion of heap, which is later overflowed using fread. Upstream bug: https://bugs.python.org/issue26171 Upstream patches: https://hg.python.org/cpython/rev/01ddd608b85c (3.4) https://hg.python.org/cpython/rev/985fc64c60d6 (2.7) https://hg.python.org/cpython/rev/10dad6da1b28 (3.5) https://hg.python.org/cpython/rev/2df462852464 (default) CVE request: http://seclists.org/oss-sec/2016/q2/524
Created python tracking bugs for this issue: Affects: fedora-all [bug 1345858]
Created jython tracking bugs for this issue: Affects: fedora-all [bug 1345857] Affects: epel-5 [bug 1345861]
Created python26 tracking bugs for this issue: Affects: epel-5 [bug 1345860]
Created python3 tracking bugs for this issue: Affects: fedora-all [bug 1345859]
The patches identified in comment#0 and upstream tracker are not complete and do not prevent the attached "crash.py" reproducer. These do: Upstream patches: https://hg.python.org/cpython/rev/2edbdb79cd6d (2.7) https://hg.python.org/cpython/rev/8b58c9328f5c (3.4) https://hg.python.org/cpython/rev/5533a9e02b21 (3.5) https://hg.python.org/cpython/rev/0f46c9a5735f (default)
CVE assignment: http://seclists.org/oss-sec/2016/q2/560
To exploit this flaw, an attacker would need to be able to place crafted files on the python import path. Since this already presents the opportunity for arbitrary code execution, this issue is rated as having Low security impact. Further, the flaw is not present in either PyPy or Jython, but only in the CPython interpreter. CPython is known to be unsuitable to create a sandbox for running untrusted user code; for this purpose either PyPy or Jython are suggested as a better fountation.
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Created python34 tracking bugs for this issue: Affects: epel-7 [bug 1356365]
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2016:2586 https://rhn.redhat.com/errata/RHSA-2016-2586.html