Bug 235093 (CVE-2007-2052) - CVE-2007-2052 python off-by-one locale.strxfrm() (possible memory disclosure)
Summary: CVE-2007-2052 python off-by-one locale.strxfrm() (possible memory disclosure)
Status: CLOSED ERRATA
Alias: CVE-2007-2052
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: James Antill
QA Contact: Brock Organ
URL: http://bugs.debian.org/cgi-bin/bugrep...
Whiteboard: impact=low,source=debian,reported=200...
Keywords: Security
Depends On: 392031 392041 392051 392061 430870 430872 436512 440511 449461 486351 486352 537915
Blocks: 444136
TreeView+ depends on / blocked
 
Reported: 2007-04-03 18:55 UTC by Red Hat Product Security
Modified: 2016-03-04 12:55 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-08-21 23:01:31 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Python's locale.strxfrm() off-by-one flaw PoC (122 bytes, text/x-python)
2007-04-03 18:55 UTC, Lubomir Kundrak
no flags Details


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:1076 normal SHIPPED_LIVE Moderate: python security update 2007-12-10 18:41:24 UTC
Red Hat Product Errata RHSA-2007:1077 normal SHIPPED_LIVE Moderate: python security update 2007-12-10 17:57:16 UTC
Red Hat Product Errata RHSA-2008:0264 normal SHIPPED_LIVE Moderate: Red Hat Network Satellite Server Solaris client security update 2008-05-20 14:16:00 UTC
Red Hat Product Errata RHSA-2008:0525 normal SHIPPED_LIVE Moderate: Red Hat Network Satellite Server Solaris client security update 2008-06-30 15:36:03 UTC
Red Hat Product Errata RHSA-2008:0629 normal SHIPPED_LIVE Moderate: Red Hat Network Satellite Server Solaris client security update 2008-08-13 14:16:13 UTC
Red Hat Product Errata RHSA-2009:1176 normal SHIPPED_LIVE Moderate: python security update 2009-07-27 09:22:50 UTC

Description Lubomir Kundrak 2007-04-03 18:55:33 UTC
Description of problem:

Modules/_localemodule.c:361
356         n1 = strlen(s) + 1;
357         buf = PyMem_Malloc(n1);
358         if (!buf)
359             return PyErr_NoMemory();
360         n2 = strxfrm(buf, s, n1);

In case the transformed string is longer than original string...
(see the PoC for an exapmle)

361         if (n2 > n1) {
362             /* more space needed */

We allocate n2 bytes here:

363             buf = PyMem_Realloc(buf, n2);
364             if (!buf)
365                 return PyErr_NoMemory();

And here the string will be n2 chars long and terminating NUL won't
fit and thus the string won't be terminated what can lead to an
information leak in certain rare cases (see the original Debian report
for details).

366             strxfrm(buf, s, n2);
367         }
368         result = PyString_FromString(buf);
369         PyMem_Free(buf);
370         return result;
371     }
372
373     #if defined(MS_WINDOWS)
374     static PyObject*
375     PyLocale_getdefaultlocale(PyObject* self)

Version-Release number of selected component (if applicable):

FC5, FC6, RHEL2.1, RHEL3, RHEL4, RHEL5

How reproducible:

Proof of concept code attached.

Additional info:

See the URL for an original bug report to Debian and PoC by Piotr Engelking.
It contains details on how to reproduce and recognize the flaw.

Comment 1 Lubomir Kundrak 2007-04-03 18:55:33 UTC
Created attachment 151611 [details]
Python's locale.strxfrm() off-by-one flaw PoC

Comment 8 Red Hat Product Security 2008-01-16 09:00:54 UTC
This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2007-1077.html (RHEL2.1)
  http://rhn.redhat.com/errata/RHSA-2007-1076.html (RHEL3, RHEL4)

Comment 15 errata-xmlrpc 2009-07-27 09:23:29 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1176 https://rhn.redhat.com/errata/RHSA-2009-1176.html

Comment 16 Red Hat Bugzilla 2009-10-23 19:04:49 UTC
Reporter changed to security-response-team@redhat.com by request of Jay Turner.


Note You need to log in before you can comment on or make changes to this bug.