Bug 235093 - (CVE-2007-2052) CVE-2007-2052 python off-by-one locale.strxfrm() (possible memory disclosure)
CVE-2007-2052 python off-by-one locale.strxfrm() (possible memory disclosure)
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: James Antill
Brock Organ
http://bugs.debian.org/cgi-bin/bugrep...
impact=low,source=debian,reported=200...
: Security
Depends On: 392031 392041 392051 392061 430870 430872 436512 440511 449461 486351 486352 537915
Blocks: 444136
  Show dependency treegraph
 
Reported: 2007-04-03 14:55 EDT by Red Hat Product Security
Modified: 2016-03-04 07:55 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-08-21 19:01:31 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
Python's locale.strxfrm() off-by-one flaw PoC (122 bytes, text/x-python)
2007-04-03 14:55 EDT, Lubomir Kundrak
no flags Details

  None (edit)
Description Lubomir Kundrak 2007-04-03 14:55:33 EDT
Description of problem:

Modules/_localemodule.c:361
356         n1 = strlen(s) + 1;
357         buf = PyMem_Malloc(n1);
358         if (!buf)
359             return PyErr_NoMemory();
360         n2 = strxfrm(buf, s, n1);

In case the transformed string is longer than original string...
(see the PoC for an exapmle)

361         if (n2 > n1) {
362             /* more space needed */

We allocate n2 bytes here:

363             buf = PyMem_Realloc(buf, n2);
364             if (!buf)
365                 return PyErr_NoMemory();

And here the string will be n2 chars long and terminating NUL won't
fit and thus the string won't be terminated what can lead to an
information leak in certain rare cases (see the original Debian report
for details).

366             strxfrm(buf, s, n2);
367         }
368         result = PyString_FromString(buf);
369         PyMem_Free(buf);
370         return result;
371     }
372
373     #if defined(MS_WINDOWS)
374     static PyObject*
375     PyLocale_getdefaultlocale(PyObject* self)

Version-Release number of selected component (if applicable):

FC5, FC6, RHEL2.1, RHEL3, RHEL4, RHEL5

How reproducible:

Proof of concept code attached.

Additional info:

See the URL for an original bug report to Debian and PoC by Piotr Engelking.
It contains details on how to reproduce and recognize the flaw.
Comment 1 Lubomir Kundrak 2007-04-03 14:55:33 EDT
Created attachment 151611 [details]
Python's locale.strxfrm() off-by-one flaw PoC
Comment 8 Red Hat Product Security 2008-01-16 04:00:54 EST
This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2007-1077.html (RHEL2.1)
  http://rhn.redhat.com/errata/RHSA-2007-1076.html (RHEL3, RHEL4)
Comment 15 errata-xmlrpc 2009-07-27 05:23:29 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1176 https://rhn.redhat.com/errata/RHSA-2009-1176.html
Comment 16 Red Hat Bugzilla 2009-10-23 15:04:49 EDT
Reporter changed to security-response-team@redhat.com by request of Jay Turner.

Note You need to log in before you can comment on or make changes to this bug.