ID SUSE_11_0_PYTHON-CRYPTO-090312.NASL Type nessus Reporter Tenable Modified 2014-06-13T00:00:00
Description
Missing checks for the key length in the ARC2 module potentially
allowed attackers to crash applications using python-crypto or
potentially even cause execute arbitrary code (CVE-2009-0544).
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update python-crypto-589.
#
# The text description of this plugin is (C) SUSE LLC.
#
include("compat.inc");
if (description)
{
script_id(40117);
script_version("$Revision: 1.8 $");
script_cvs_date("$Date: 2014/06/13 19:44:03 $");
script_cve_id("CVE-2009-0544");
script_name(english:"openSUSE Security Update : python-crypto (python-crypto-589)");
script_summary(english:"Check for the python-crypto-589 patch");
script_set_attribute(
attribute:"synopsis",
value:"The remote openSUSE host is missing a security update."
);
script_set_attribute(
attribute:"description",
value:
"Missing checks for the key length in the ARC2 module potentially
allowed attackers to crash applications using python-crypto or
potentially even cause execute arbitrary code (CVE-2009-0544)."
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.novell.com/show_bug.cgi?id=483345"
);
script_set_attribute(
attribute:"solution",
value:"Update the affected python-crypto package."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_cwe_id(119);
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-crypto");
script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.0");
script_set_attribute(attribute:"patch_publication_date", value:"2009/03/12");
script_set_attribute(attribute:"plugin_publication_date", value:"2009/07/21");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2009-2014 Tenable Network Security, Inc.");
script_family(english:"SuSE Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE11\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.0", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
flag = 0;
if ( rpm_check(release:"SUSE11.0", reference:"python-crypto-2.0.1-164.2") ) flag++;
if (flag)
{
if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
else security_hole(0);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python-crypto");
}
{"id": "SUSE_11_0_PYTHON-CRYPTO-090312.NASL", "bulletinFamily": "scanner", "title": "openSUSE Security Update : python-crypto (python-crypto-589)", "description": "Missing checks for the key length in the ARC2 module potentially\nallowed attackers to crash applications using python-crypto or\npotentially even cause execute arbitrary code (CVE-2009-0544).", "published": "2009-07-21T00:00:00", "modified": "2014-06-13T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=40117", "reporter": "Tenable", "references": ["https://bugzilla.novell.com/show_bug.cgi?id=483345"], "cvelist": ["CVE-2009-0544"], "type": "nessus", "lastseen": "2019-01-16T20:09:32", "history": [{"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:novell:opensuse:11.0", "p-cpe:/a:novell:opensuse:python-crypto"], "cvelist": ["CVE-2009-0544"], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "Missing checks for the key length in the ARC2 module potentially allowed attackers to crash applications using python-crypto or potentially even cause execute arbitrary code (CVE-2009-0544).", "edition": 3, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}}, "hash": "bebf2df2dd5f81644f47ba20a17e0d55bd48998c7f716474f18fa18ed78549e5", "hashmap": [{"hash": "d76add9159a9346d899edd98276877ca", "key": "description"}, {"hash": "dbaf25e052cd493640d30c7ef9a7a003", "key": "pluginID"}, {"hash": "f30a8ba89555c3b56ab437e899e0133a", "key": "href"}, {"hash": "11d182b8840a8171a4147b86e619a254", "key": "cvelist"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "edeafa1b466f0a60ebd19a662eb2d474", "key": "references"}, {"hash": "f6072b14a6f1638d4d1cb42c6e52f63a", "key": "title"}, {"hash": "02fcc0c238d215158fbaabb854c5b3df", "key": "modified"}, {"hash": "f711391ddb3cf1e3d1423af851186023", "key": "cpe"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "80c4269d5ee41289337964052f124f38", "key": "sourceData"}, {"hash": "71a40666da62ba38d22539c8277870c7", "key": "naslFamily"}, {"hash": "6e74cbd2638253438b2471ba1b6bdfb5", "key": "published"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=40117", "id": "SUSE_11_0_PYTHON-CRYPTO-090312.NASL", "lastseen": "2018-08-30T19:48:09", "modified": "2014-06-13T00:00:00", "naslFamily": "SuSE Local Security Checks", "objectVersion": "1.3", "pluginID": "40117", "published": "2009-07-21T00:00:00", "references": ["https://bugzilla.novell.com/show_bug.cgi?id=483345"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update python-crypto-589.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(40117);\n script_version(\"$Revision: 1.8 $\");\n script_cvs_date(\"$Date: 2014/06/13 19:44:03 $\");\n\n script_cve_id(\"CVE-2009-0544\");\n\n script_name(english:\"openSUSE Security Update : python-crypto (python-crypto-589)\");\n script_summary(english:\"Check for the python-crypto-589 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Missing checks for the key length in the ARC2 module potentially\nallowed attackers to crash applications using python-crypto or\npotentially even cause execute arbitrary code (CVE-2009-0544).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=483345\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected python-crypto package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python-crypto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:11.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/03/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/07/21\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2014 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE11\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"11.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE11.0\", reference:\"python-crypto-2.0.1-164.2\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"python-crypto\");\n}\n", "title": "openSUSE Security Update : python-crypto (python-crypto-589)", "type": "nessus", "viewCount": 1}, "differentElements": ["cvss"], "edition": 3, "lastseen": "2018-08-30T19:48:09"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": [], "cvelist": ["CVE-2009-0544"], "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "Missing checks for the key length in the ARC2 module potentially allowed attackers to crash applications using python-crypto or potentially even cause execute arbitrary code (CVE-2009-0544).", "edition": 1, "enchantments": {}, "hash": "ff95bcc6bebc85aebc3b466781d3b8d62237b2bdf6dda045e69d2f24ce75414b", "hashmap": [{"hash": "d76add9159a9346d899edd98276877ca", "key": "description"}, {"hash": "dbaf25e052cd493640d30c7ef9a7a003", "key": "pluginID"}, {"hash": "f30a8ba89555c3b56ab437e899e0133a", "key": "href"}, {"hash": "11d182b8840a8171a4147b86e619a254", "key": "cvelist"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "edeafa1b466f0a60ebd19a662eb2d474", "key": "references"}, {"hash": "2bdabeb49c44761f9565717ab0e38165", "key": "cvss"}, {"hash": "f6072b14a6f1638d4d1cb42c6e52f63a", "key": "title"}, {"hash": "02fcc0c238d215158fbaabb854c5b3df", "key": "modified"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "80c4269d5ee41289337964052f124f38", "key": "sourceData"}, {"hash": "71a40666da62ba38d22539c8277870c7", "key": "naslFamily"}, {"hash": "6e74cbd2638253438b2471ba1b6bdfb5", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=40117", "id": "SUSE_11_0_PYTHON-CRYPTO-090312.NASL", "lastseen": "2016-09-26T17:25:20", "modified": "2014-06-13T00:00:00", "naslFamily": "SuSE Local Security Checks", "objectVersion": "1.2", "pluginID": "40117", "published": "2009-07-21T00:00:00", "references": ["https://bugzilla.novell.com/show_bug.cgi?id=483345"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update python-crypto-589.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(40117);\n script_version(\"$Revision: 1.8 $\");\n script_cvs_date(\"$Date: 2014/06/13 19:44:03 $\");\n\n script_cve_id(\"CVE-2009-0544\");\n\n script_name(english:\"openSUSE Security Update : python-crypto (python-crypto-589)\");\n script_summary(english:\"Check for the python-crypto-589 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Missing checks for the key length in the ARC2 module potentially\nallowed attackers to crash applications using python-crypto or\npotentially even cause execute arbitrary code (CVE-2009-0544).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=483345\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected python-crypto package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python-crypto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:11.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/03/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/07/21\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2014 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE11\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"11.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE11.0\", reference:\"python-crypto-2.0.1-164.2\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"python-crypto\");\n}\n", "title": "openSUSE Security Update : python-crypto (python-crypto-589)", "type": "nessus", "viewCount": 1}, "differentElements": ["cpe"], "edition": 1, "lastseen": "2016-09-26T17:25:20"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:novell:opensuse:11.0", "p-cpe:/a:novell:opensuse:python-crypto"], "cvelist": ["CVE-2009-0544"], "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "Missing checks for the key length in the ARC2 module potentially allowed attackers to crash applications using python-crypto or potentially even cause execute arbitrary code (CVE-2009-0544).", "edition": 2, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}}, "hash": "90e78496d5a916f9f13167bd6b86fb6e0288a391b3ab785f196dfe87a748538e", "hashmap": [{"hash": "d76add9159a9346d899edd98276877ca", "key": "description"}, {"hash": "dbaf25e052cd493640d30c7ef9a7a003", "key": "pluginID"}, {"hash": "f30a8ba89555c3b56ab437e899e0133a", "key": "href"}, {"hash": "11d182b8840a8171a4147b86e619a254", "key": "cvelist"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "edeafa1b466f0a60ebd19a662eb2d474", "key": "references"}, {"hash": "2bdabeb49c44761f9565717ab0e38165", "key": "cvss"}, {"hash": "f6072b14a6f1638d4d1cb42c6e52f63a", "key": "title"}, {"hash": "02fcc0c238d215158fbaabb854c5b3df", "key": "modified"}, {"hash": "f711391ddb3cf1e3d1423af851186023", "key": "cpe"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "80c4269d5ee41289337964052f124f38", "key": "sourceData"}, {"hash": "71a40666da62ba38d22539c8277870c7", "key": "naslFamily"}, {"hash": "6e74cbd2638253438b2471ba1b6bdfb5", "key": "published"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=40117", "id": "SUSE_11_0_PYTHON-CRYPTO-090312.NASL", "lastseen": "2017-10-29T13:40:44", "modified": "2014-06-13T00:00:00", "naslFamily": "SuSE Local Security Checks", "objectVersion": "1.3", "pluginID": "40117", "published": "2009-07-21T00:00:00", "references": ["https://bugzilla.novell.com/show_bug.cgi?id=483345"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update python-crypto-589.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(40117);\n script_version(\"$Revision: 1.8 $\");\n script_cvs_date(\"$Date: 2014/06/13 19:44:03 $\");\n\n script_cve_id(\"CVE-2009-0544\");\n\n script_name(english:\"openSUSE Security Update : python-crypto (python-crypto-589)\");\n script_summary(english:\"Check for the python-crypto-589 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Missing checks for the key length in the ARC2 module potentially\nallowed attackers to crash applications using python-crypto or\npotentially even cause execute arbitrary code (CVE-2009-0544).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=483345\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected python-crypto package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python-crypto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:11.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/03/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/07/21\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2014 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE11\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"11.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE11.0\", reference:\"python-crypto-2.0.1-164.2\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"python-crypto\");\n}\n", "title": "openSUSE Security Update : python-crypto (python-crypto-589)", "type": "nessus", "viewCount": 1}, "differentElements": ["cvss"], "edition": 2, "lastseen": "2017-10-29T13:40:44"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:novell:opensuse:11.0", "p-cpe:/a:novell:opensuse:python-crypto"], "cvelist": ["CVE-2009-0544"], "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "Missing checks for the key length in the ARC2 module potentially allowed attackers to crash applications using python-crypto or potentially even cause execute arbitrary code (CVE-2009-0544).", "edition": 4, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}}, "hash": "90e78496d5a916f9f13167bd6b86fb6e0288a391b3ab785f196dfe87a748538e", "hashmap": [{"hash": "d76add9159a9346d899edd98276877ca", "key": "description"}, {"hash": "dbaf25e052cd493640d30c7ef9a7a003", "key": "pluginID"}, {"hash": "f30a8ba89555c3b56ab437e899e0133a", "key": "href"}, {"hash": "11d182b8840a8171a4147b86e619a254", "key": "cvelist"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "edeafa1b466f0a60ebd19a662eb2d474", "key": "references"}, {"hash": "2bdabeb49c44761f9565717ab0e38165", "key": "cvss"}, {"hash": "f6072b14a6f1638d4d1cb42c6e52f63a", "key": "title"}, {"hash": "02fcc0c238d215158fbaabb854c5b3df", "key": "modified"}, {"hash": "f711391ddb3cf1e3d1423af851186023", "key": "cpe"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "80c4269d5ee41289337964052f124f38", "key": "sourceData"}, {"hash": "71a40666da62ba38d22539c8277870c7", "key": "naslFamily"}, {"hash": "6e74cbd2638253438b2471ba1b6bdfb5", "key": "published"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=40117", "id": "SUSE_11_0_PYTHON-CRYPTO-090312.NASL", "lastseen": "2018-09-01T23:54:13", "modified": "2014-06-13T00:00:00", "naslFamily": "SuSE Local Security Checks", "objectVersion": "1.3", "pluginID": "40117", "published": "2009-07-21T00:00:00", "references": ["https://bugzilla.novell.com/show_bug.cgi?id=483345"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update python-crypto-589.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(40117);\n script_version(\"$Revision: 1.8 $\");\n script_cvs_date(\"$Date: 2014/06/13 19:44:03 $\");\n\n script_cve_id(\"CVE-2009-0544\");\n\n script_name(english:\"openSUSE Security Update : python-crypto (python-crypto-589)\");\n script_summary(english:\"Check for the python-crypto-589 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Missing checks for the key length in the ARC2 module potentially\nallowed attackers to crash applications using python-crypto or\npotentially even cause execute arbitrary code (CVE-2009-0544).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=483345\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected python-crypto package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python-crypto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:11.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/03/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/07/21\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2014 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE11\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"11.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE11.0\", reference:\"python-crypto-2.0.1-164.2\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"python-crypto\");\n}\n", "title": "openSUSE Security Update : python-crypto (python-crypto-589)", "type": "nessus", "viewCount": 1}, "differentElements": ["description"], "edition": 4, "lastseen": "2018-09-01T23:54:13"}], "edition": 5, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cpe", "hash": "f711391ddb3cf1e3d1423af851186023"}, {"key": "cvelist", "hash": "11d182b8840a8171a4147b86e619a254"}, {"key": "cvss", "hash": "2bdabeb49c44761f9565717ab0e38165"}, {"key": "description", "hash": "8dc47caa7a365779c2097779bbdd6fac"}, {"key": "href", "hash": "f30a8ba89555c3b56ab437e899e0133a"}, {"key": "modified", "hash": "02fcc0c238d215158fbaabb854c5b3df"}, {"key": "naslFamily", "hash": "71a40666da62ba38d22539c8277870c7"}, {"key": "pluginID", "hash": "dbaf25e052cd493640d30c7ef9a7a003"}, {"key": "published", "hash": "6e74cbd2638253438b2471ba1b6bdfb5"}, {"key": "references", "hash": "edeafa1b466f0a60ebd19a662eb2d474"}, {"key": "reporter", "hash": "9cf00d658b687f030ebe173a0528c567"}, {"key": "sourceData", "hash": "80c4269d5ee41289337964052f124f38"}, {"key": "title", "hash": "f6072b14a6f1638d4d1cb42c6e52f63a"}, {"key": "type", "hash": "5e0bd03bec244039678f2b955a2595aa"}], "hash": "e5bc2ea6bffa269e5379052964245adb30db79ef3a2a1496f1486d54561dd97d", "viewCount": 1, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2009-0544"]}, {"type": "openvas", "idList": ["OPENVAS:136141256231063542", "OPENVAS:136141256231063439", "OPENVAS:63437", "OPENVAS:63572", "OPENVAS:63438", "OPENVAS:63542", "OPENVAS:136141256231063441", "OPENVAS:136141256231063438", "OPENVAS:63509", "OPENVAS:63439"]}, {"type": "debian", "idList": ["DEBIAN:DSA-1726-1:B28ED"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:21382", "SECURITYVULNS:VULN:9690"]}, {"type": "exploitdb", "idList": ["EDB-ID:32780"]}, {"type": "nessus", "idList": ["SUSE_PYTHON-CRYPTO-6063.NASL", "GENTOO_GLSA-200903-11.NASL", "DEBIAN_DSA-1726.NASL", "MANDRIVA_MDVSA-2009-049.NASL", "MANDRIVA_MDVSA-2009-050.NASL", "UBUNTU_USN-729-1.NASL", "SUSE_11_1_PYTHON-CRYPTO-090312.NASL"]}, {"type": "seebug", "idList": ["SSV:4798"]}, {"type": "gentoo", "idList": ["GLSA-200903-11"]}, {"type": "ubuntu", "idList": ["USN-729-1"]}], "modified": "2019-01-16T20:09:32"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update python-crypto-589.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(40117);\n script_version(\"$Revision: 1.8 $\");\n script_cvs_date(\"$Date: 2014/06/13 19:44:03 $\");\n\n script_cve_id(\"CVE-2009-0544\");\n\n script_name(english:\"openSUSE Security Update : python-crypto (python-crypto-589)\");\n script_summary(english:\"Check for the python-crypto-589 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Missing checks for the key length in the ARC2 module potentially\nallowed attackers to crash applications using python-crypto or\npotentially even cause execute arbitrary code (CVE-2009-0544).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=483345\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected python-crypto package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python-crypto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:11.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/03/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/07/21\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2014 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE11\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"11.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE11.0\", reference:\"python-crypto-2.0.1-164.2\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"python-crypto\");\n}\n", "naslFamily": "SuSE Local Security Checks", "pluginID": "40117", "cpe": ["cpe:/o:novell:opensuse:11.0", "p-cpe:/a:novell:opensuse:python-crypto"]}
{"cve": [{"lastseen": "2017-08-08T11:25:14", "bulletinFamily": "NVD", "description": "Buffer overflow in the PyCrypto ARC2 module 2.0.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large ARC2 key length.", "modified": "2017-08-07T21:33:59", "published": "2009-02-12T12:30:00", "id": "CVE-2009-0544", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0544", "title": "CVE-2009-0544", "type": "cve", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "exploitdb": [{"lastseen": "2016-02-03T17:47:07", "bulletinFamily": "exploit", "description": "PyCrypto ARC2 Module Buffer Overflow Vulnerability. CVE-2009-0544 . Remote exploit for linux platform", "modified": "2009-02-07T00:00:00", "published": "2009-02-07T00:00:00", "id": "EDB-ID:32780", "href": "https://www.exploit-db.com/exploits/32780/", "type": "exploitdb", "title": "PyCrypto ARC2 Module Buffer Overflow Vulnerability", "sourceData": "source: http://www.securityfocus.com/bid/33674/info\r\n\r\nPyCrypto (Python Cryptography Toolkit) is prone to a buffer-overflow vulnerability because it fails to adequately verify user-supplied input.\r\n\r\nSuccessful exploits may allow attackers to execute arbitrary code in the context of applications using the vulnerable module. Failed attempts may lead to a denial-of-service condition.\r\n\r\n# -*- coding: utf-8 -*-\r\n#\r\n# SelfTest/Cipher/ARC2.py: Self-test for the Alleged-RC2 cipher\r\n#\r\n# =======================================================================\r\n# Copyright (C) 2008 Dwayne C. Litzenberger <dlitz@dlitz.net>\r\n#\r\n# Permission is hereby granted, free of charge, to any person obtaining\r\n# a copy of this software and associated documentation files (the\r\n# \"Software\"), to deal in the Software without restriction, including\r\n# without limitation the rights to use, copy, modify, merge, publish,\r\n# distribute, sublicense, and/or sell copies of the Software, and to\r\n# permit persons to whom the Software is furnished to do so.\r\n#\r\n# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\r\n# \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\r\n# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\r\n# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\r\n# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\r\n# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\r\n# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\r\n# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\r\n# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\r\n# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\r\n# =======================================================================\r\n#\r\n\r\n\"\"\"Self-test suite for Crypto.Cipher.ARC2\"\"\"\r\n\r\n__revision__ = \"$Id$\"\r\n\r\nfrom common import dict # For compatibility with Python 2.1 and 2.2\r\n\r\nimport unittest\r\n\r\n# This is a list of (plaintext, ciphertext, key[, description[, extra_params]]) tuples.\r\ntest_data = [\r\n # Test vectors from RFC 2268\r\n\r\n # 63-bit effective key length\r\n ('0000000000000000', 'ebb773f993278eff', '0000000000000000',\r\n 'RFC2268-1', dict(effective_keylen=63)),\r\n\r\n # 64-bit effective key length\r\n ('ffffffffffffffff', '278b27e42e2f0d49', 'ffffffffffffffff',\r\n 'RFC2268-2', dict(effective_keylen=64)),\r\n ('1000000000000001', '30649edf9be7d2c2', '3000000000000000',\r\n 'RFC2268-3', dict(effective_keylen=64)),\r\n ('0000000000000000', '61a8a244adacccf0', '88',\r\n 'RFC2268-4', dict(effective_keylen=64)),\r\n ('0000000000000000', '6ccf4308974c267f', '88bca90e90875a',\r\n 'RFC2268-5', dict(effective_keylen=64)),\r\n ('0000000000000000', '1a807d272bbe5db1', '88bca90e90875a7f0f79c384627bafb2',\r\n 'RFC2268-6', dict(effective_keylen=64)),\r\n\r\n # 128-bit effective key length\r\n ('0000000000000000', '2269552ab0f85ca6', '88bca90e90875a7f0f79c384627bafb2',\r\n \"RFC2268-7\", dict(effective_keylen=128)),\r\n ('0000000000000000', '5b78d3a43dfff1f1',\r\n '88bca90e90875a7f0f79c384627bafb216f80a6f85920584c42fceb0be255daf1e',\r\n \"RFC2268-8\", dict(effective_keylen=129)),\r\n\r\n # Test vectors from PyCrypto 2.0.1's testdata.py\r\n # 1024-bit effective key length\r\n ('0000000000000000', '624fb3e887419e48', '5068696c6970476c617373',\r\n 'PCTv201-0'),\r\n ('ffffffffffffffff', '79cadef44c4a5a85', '5068696c6970476c617373',\r\n 'PCTv201-1'),\r\n ('0001020304050607', '90411525b34e4c2c', '5068696c6970476c617373',\r\n 'PCTv201-2'),\r\n ('0011223344556677', '078656aaba61cbfb', '5068696c6970476c617373',\r\n 'PCTv201-3'),\r\n ('0000000000000000', 'd7bcc5dbb4d6e56a', 'ffffffffffffffff', 'PCTv201-4'),\r\n ('ffffffffffffffff', '7259018ec557b357', 'ffffffffffffffff', 'PCTv201-5'),\r\n ('0001020304050607', '93d20a497f2ccb62', 'ffffffffffffffff', 'PCTv201-6'),\r\n ('0011223344556677', 'cb15a7f819c0014d', 'ffffffffffffffff', 'PCTv201-7'),\r\n ('0000000000000000', '63ac98cdf3843a7a',\r\n 'ffffffffffffffff5065746572477265656e6177617953e5ffe553',\r\n 'PCTv201-8'),\r\n ('ffffffffffffffff', '3fb49e2fa12371dd',\r\n 'ffffffffffffffff5065746572477265656e6177617953e5ffe553',\r\n 'PCTv201-9'),\r\n ('0001020304050607', '46414781ab387d5f',\r\n 'ffffffffffffffff5065746572477265656e6177617953e5ffe553',\r\n 'PCTv201-10'),\r\n ('0011223344556677', 'be09dc81feaca271',\r\n 'ffffffffffffffff5065746572477265656e6177617953e5ffe553',\r\n 'PCTv201-11'),\r\n ('0000000000000000', 'e64221e608be30ab', '53e5ffe553', 'PCTv201-12'),\r\n ('ffffffffffffffff', '862bc60fdcd4d9a9', '53e5ffe553', 'PCTv201-13'),\r\n ('0001020304050607', '6a34da50fa5e47de', '53e5ffe553', 'PCTv201-14'),\r\n ('0011223344556677', '584644c34503122c', '53e5ffe553', 'PCTv201-15'),\r\n]\r\n\r\nclass BufferOverflowTest(unittest.TestCase):\r\n # Test a buffer overflow found in older versions of PyCrypto\r\n\r\n def setUp(self):\r\n global ARC2\r\n from Crypto.Cipher import ARC2\r\n\r\n def runTest(self):\r\n \"\"\"ARC2 with keylength > 128\"\"\"\r\n key = \"x\" * 16384\r\n mode = ARC2.MODE_ECB\r\n self.assertRaises(ValueError, ARC2.new, key, mode)\r\n\r\ndef get_tests(config={}):\r\n from Crypto.Cipher import ARC2\r\n from common import make_block_tests\r\n\r\n tests = make_block_tests(ARC2, \"ARC2\", test_data)\r\n tests.append(BufferOverflowTest())\r\n\r\n return tests\r\n\r\nif __name__ == '__main__':\r\n import unittest\r\n suite = lambda: unittest.TestSuite(get_tests())\r\n unittest.main(defaultTest='suite')\r\n\r\n# vim:set ts=4 sw=4 sts=4 expandtab:\r\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://www.exploit-db.com/download/32780/"}], "openvas": [{"lastseen": "2018-04-06T11:37:50", "bulletinFamily": "scanner", "description": "The remote host is missing an update to python-pycrypto\nannounced via advisory MDVSA-2009:050.", "modified": "2018-04-06T00:00:00", "published": "2009-03-02T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231063438", "id": "OPENVAS:136141256231063438", "title": "Mandrake Security Advisory MDVSA-2009:050 (python-pycrypto)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_050.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:050 (python-pycrypto)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability have been discovered and corrected in PyCrypto\nARC2 module 2.0.1, which allows remote attackers to cause a denial\nof service and possibly execute arbitrary code via a large ARC2 key\nlength (CVE-2009-0544).\n\nThe updated packages have been patched to prevent this.\n\nAffected: 2009.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:050\";\ntag_summary = \"The remote host is missing an update to python-pycrypto\nannounced via advisory MDVSA-2009:050.\";\n\n \n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.63438\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-03-02 19:11:09 +0100 (Mon, 02 Mar 2009)\");\n script_cve_id(\"CVE-2009-0544\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:050 (python-pycrypto)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"python-pycrypto\", rpm:\"python-pycrypto~2.0.1~4.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-04T11:28:53", "bulletinFamily": "scanner", "description": "The remote host is missing an update to python-crypto\nannounced via advisory USN-729-1.", "modified": "2017-12-01T00:00:00", "published": "2009-03-07T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=63509", "id": "OPENVAS:63509", "title": "Ubuntu USN-729-1 (python-crypto)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: ubuntu_729_1.nasl 7969 2017-12-01 09:23:16Z santu $\n# $Id: ubuntu_729_1.nasl 7969 2017-12-01 09:23:16Z santu $\n# Description: Auto-generated from advisory USN-729-1 (python-crypto)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_solution = \"The problem can be corrected by upgrading your system to the\n following package versions:\n\nUbuntu 6.06 LTS:\n python2.4-crypto 2.0.1+dfsg1-1ubuntu1.1\n\nUbuntu 7.10:\n python-crypto 2.0.1+dfsg1-2ubuntu1.1\n\nUbuntu 8.04 LTS:\n python-crypto 2.0.1+dfsg1-2.1ubuntu1.1\n\nUbuntu 8.10:\n python-crypto 2.0.1+dfsg1-2.3ubuntu0.1\n\nIn general, a standard system upgrade is sufficient to effect the\nnecessary changes.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=USN-729-1\";\n\ntag_insight = \"Mike Wiacek discovered that the ARC2 implementation in Python Crypto\ndid not correctly check the key length. If a user or automated system\nwere tricked into processing a malicious ARC2 stream, a remote attacker\ncould execute arbitrary code or crash the application using Python Crypto,\nleading to a denial of service.\";\ntag_summary = \"The remote host is missing an update to python-crypto\nannounced via advisory USN-729-1.\";\n\n \n\n\nif(description)\n{\n script_id(63509);\n script_version(\"$Revision: 7969 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-01 10:23:16 +0100 (Fri, 01 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-03-07 21:47:03 +0100 (Sat, 07 Mar 2009)\");\n script_cve_id(\"CVE-2009-0544\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Ubuntu USN-729-1 (python-crypto)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n script_xref(name: \"URL\" , value: \"http://www.ubuntu.com/usn/usn-729-1/\");\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"python-crypto\", ver:\"2.0.1+dfsg1-1ubuntu1.1\", rls:\"UBUNTU6.06 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"python2.4-crypto\", ver:\"2.0.1+dfsg1-1ubuntu1.1\", rls:\"UBUNTU6.06 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"python-crypto-dbg\", ver:\"2.0.1+dfsg1-2ubuntu1.1\", rls:\"UBUNTU7.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"python-crypto\", ver:\"2.0.1+dfsg1-2ubuntu1.1\", rls:\"UBUNTU7.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"python-crypto-dbg\", ver:\"2.0.1+dfsg1-2.1ubuntu1.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"python-crypto\", ver:\"2.0.1+dfsg1-2.1ubuntu1.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"python-crypto-dbg\", ver:\"2.0.1+dfsg1-2.3ubuntu0.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"python-crypto\", ver:\"2.0.1+dfsg1-2.3ubuntu0.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:56:50", "bulletinFamily": "scanner", "description": "The remote host is missing an update to python-pycrypto\nannounced via advisory MDVSA-2009:050-1.", "modified": "2017-07-06T00:00:00", "published": "2009-03-02T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=63439", "id": "OPENVAS:63439", "title": "Mandrake Security Advisory MDVSA-2009:050-1 (python-pycrypto)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_050_1.nasl 6573 2017-07-06 13:10:50Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:050-1 (python-pycrypto)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability have been discovered and corrected in PyCrypto\nARC2 module 2.0.1, which allows remote attackers to cause a denial\nof service and possibly execute arbitrary code via a large ARC2 key\nlength (CVE-2009-0544).\n\nThe updated packages have been patched to prevent this.\n\nUpdate:\n\nThe previous update package was not signed.\n\nAffected: 2009.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:050-1\";\ntag_summary = \"The remote host is missing an update to python-pycrypto\nannounced via advisory MDVSA-2009:050-1.\";\n\n \n\nif(description)\n{\n script_id(63439);\n script_version(\"$Revision: 6573 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 15:10:50 +0200 (Thu, 06 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-03-02 19:11:09 +0100 (Mon, 02 Mar 2009)\");\n script_cve_id(\"CVE-2009-0544\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:050-1 (python-pycrypto)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"python-pycrypto\", rpm:\"python-pycrypto~2.0.1~4.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:57:04", "bulletinFamily": "scanner", "description": "The remote host is missing updates announced in\nadvisory GLSA 200903-11.", "modified": "2017-07-07T00:00:00", "published": "2009-03-13T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=63542", "id": "OPENVAS:63542", "title": "Gentoo Security Advisory GLSA 200903-11 (pycrypto)", "type": "openvas", "sourceData": "#\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A buffer overflow in PyCrypto might lead to the execution of arbitrary code\nwhen decrypting using ARC2.\";\ntag_solution = \"All PyCrypto users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=dev-python/pycrypto-2.0.1-r8'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200903-11\nhttp://bugs.gentoo.org/show_bug.cgi?id=258049\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200903-11.\";\n\n \n \n\nif(description)\n{\n script_id(63542);\n script_version(\"$Revision: 6595 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:19:55 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-03-13 19:24:56 +0100 (Fri, 13 Mar 2009)\");\n script_cve_id(\"CVE-2009-0544\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Gentoo Security Advisory GLSA 200903-11 (pycrypto)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"dev-python/pycrypto\", unaffected: make_list(\"ge 2.0.1-r8\"), vulnerable: make_list(\"lt 2.0.1-r8\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:56:18", "bulletinFamily": "scanner", "description": "The remote host is missing an update to python-crypto\nannounced via advisory DSA 1726-1.", "modified": "2017-07-07T00:00:00", "published": "2009-03-20T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=63572", "id": "OPENVAS:63572", "title": "Debian Security Advisory DSA 1726-1 (python-crypto)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_1726_1.nasl 6615 2017-07-07 12:09:52Z cfischer $\n# Description: Auto-generated from advisory DSA 1726-1 (python-crypto)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Mike Wiacek discovered that a buffer overflow in the ARC2 implementation\nof Python Crypto, a collection of cryptographic algorithms and protocols\nfor Python allows denial of service and potentially the execution of\narbitrary code.\n\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.0.1+dfsg1-2.3+lenny0.\n\nDue to a technical limitation in the Debian archive management scripts\nthe update for the old stable distribution (etch) cannot be released\nsynchronously. It will be fixed in version 2.0.1+dfsg1-1.2+etch0 soon.\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your python-crypto package.\";\ntag_summary = \"The remote host is missing an update to python-crypto\nannounced via advisory DSA 1726-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201726-1\";\n\n\nif(description)\n{\n script_id(63572);\n script_version(\"$Revision: 6615 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:09:52 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-03-20 00:52:38 +0100 (Fri, 20 Mar 2009)\");\n script_cve_id(\"CVE-2009-0544\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Debian Security Advisory DSA 1726-1 (python-crypto)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"python-crypto-dbg\", ver:\"2.0.1+dfsg1-2.3+lenny0\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"python-crypto\", ver:\"2.0.1+dfsg1-2.3+lenny0\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:37:53", "bulletinFamily": "scanner", "description": "The remote host is missing an update to pycrypto\nannounced via advisory MDVSA-2009:049-1.", "modified": "2018-04-06T00:00:00", "published": "2009-03-02T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231063441", "id": "OPENVAS:136141256231063441", "type": "openvas", "title": "Mandrake Security Advisory MDVSA-2009:049-1 (pycrypto)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_049_1.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:049-1 (pycrypto)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability have been discovered and corrected in PyCrypto\nARC2 module 2.0.1, which allows remote attackers to cause a denial\nof service and possibly execute arbitrary code via a large ARC2 key\nlength (CVE-2009-0544).\n\nThe updated packages have been patched to prevent this.\n\nUpdate:\n\nThe previous update package was not signed.\n\nAffected: 2008.0, 2008.1, 2009.0, Corporate 4.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:049-1\";\ntag_summary = \"The remote host is missing an update to pycrypto\nannounced via advisory MDVSA-2009:049-1.\";\n\n \n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.63441\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-03-02 19:11:09 +0100 (Mon, 02 Mar 2009)\");\n script_cve_id(\"CVE-2009-0544\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:049-1 (pycrypto)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"pycrypto\", rpm:\"pycrypto~2.0.1~1.2mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"pycrypto\", rpm:\"pycrypto~2.0.1~2.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"pycrypto\", rpm:\"pycrypto~2.0.1~3.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"pycrypto\", rpm:\"pycrypto~2.0~1.2.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:39:30", "bulletinFamily": "scanner", "description": "The remote host is missing an update to python-pycrypto\nannounced via advisory MDVSA-2009:050-1.", "modified": "2018-04-06T00:00:00", "published": "2009-03-02T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231063439", "id": "OPENVAS:136141256231063439", "type": "openvas", "title": "Mandrake Security Advisory MDVSA-2009:050-1 (python-pycrypto)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_050_1.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:050-1 (python-pycrypto)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability have been discovered and corrected in PyCrypto\nARC2 module 2.0.1, which allows remote attackers to cause a denial\nof service and possibly execute arbitrary code via a large ARC2 key\nlength (CVE-2009-0544).\n\nThe updated packages have been patched to prevent this.\n\nUpdate:\n\nThe previous update package was not signed.\n\nAffected: 2009.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:050-1\";\ntag_summary = \"The remote host is missing an update to python-pycrypto\nannounced via advisory MDVSA-2009:050-1.\";\n\n \n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.63439\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-03-02 19:11:09 +0100 (Mon, 02 Mar 2009)\");\n script_cve_id(\"CVE-2009-0544\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:050-1 (python-pycrypto)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"python-pycrypto\", rpm:\"python-pycrypto~2.0.1~4.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:56:15", "bulletinFamily": "scanner", "description": "The remote host is missing an update to python-pycrypto\nannounced via advisory MDVSA-2009:050.", "modified": "2017-07-06T00:00:00", "published": "2009-03-02T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=63438", "id": "OPENVAS:63438", "title": "Mandrake Security Advisory MDVSA-2009:050 (python-pycrypto)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_050.nasl 6573 2017-07-06 13:10:50Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:050 (python-pycrypto)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability have been discovered and corrected in PyCrypto\nARC2 module 2.0.1, which allows remote attackers to cause a denial\nof service and possibly execute arbitrary code via a large ARC2 key\nlength (CVE-2009-0544).\n\nThe updated packages have been patched to prevent this.\n\nAffected: 2009.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:050\";\ntag_summary = \"The remote host is missing an update to python-pycrypto\nannounced via advisory MDVSA-2009:050.\";\n\n \n\nif(description)\n{\n script_id(63438);\n script_version(\"$Revision: 6573 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 15:10:50 +0200 (Thu, 06 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-03-02 19:11:09 +0100 (Mon, 02 Mar 2009)\");\n script_cve_id(\"CVE-2009-0544\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:050 (python-pycrypto)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"python-pycrypto\", rpm:\"python-pycrypto~2.0.1~4.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:40:10", "bulletinFamily": "scanner", "description": "The remote host is missing updates announced in\nadvisory GLSA 200903-11.", "modified": "2018-04-06T00:00:00", "published": "2009-03-13T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231063542", "id": "OPENVAS:136141256231063542", "title": "Gentoo Security Advisory GLSA 200903-11 (pycrypto)", "type": "openvas", "sourceData": "#\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A buffer overflow in PyCrypto might lead to the execution of arbitrary code\nwhen decrypting using ARC2.\";\ntag_solution = \"All PyCrypto users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=dev-python/pycrypto-2.0.1-r8'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200903-11\nhttp://bugs.gentoo.org/show_bug.cgi?id=258049\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200903-11.\";\n\n \n \n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.63542\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-03-13 19:24:56 +0100 (Fri, 13 Mar 2009)\");\n script_cve_id(\"CVE-2009-0544\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Gentoo Security Advisory GLSA 200903-11 (pycrypto)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"dev-python/pycrypto\", unaffected: make_list(\"ge 2.0.1-r8\"), vulnerable: make_list(\"lt 2.0.1-r8\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:56:19", "bulletinFamily": "scanner", "description": "The remote host is missing an update to pycrypto\nannounced via advisory MDVSA-2009:049.", "modified": "2017-07-06T00:00:00", "published": "2009-03-02T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=63437", "id": "OPENVAS:63437", "title": "Mandrake Security Advisory MDVSA-2009:049 (pycrypto)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_049.nasl 6573 2017-07-06 13:10:50Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:049 (pycrypto)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability have been discovered and corrected in PyCrypto\nARC2 module 2.0.1, which allows remote attackers to cause a denial\nof service and possibly execute arbitrary code via a large ARC2 key\nlength (CVE-2009-0544).\n\nThe updated packages have been patched to prevent this.\n\nAffected: 2008.0, 2008.1, 2009.0, Corporate 4.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:049\";\ntag_summary = \"The remote host is missing an update to pycrypto\nannounced via advisory MDVSA-2009:049.\";\n\n \n\nif(description)\n{\n script_id(63437);\n script_version(\"$Revision: 6573 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 15:10:50 +0200 (Thu, 06 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-03-02 19:11:09 +0100 (Mon, 02 Mar 2009)\");\n script_cve_id(\"CVE-2009-0544\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:049 (pycrypto)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"pycrypto\", rpm:\"pycrypto~2.0.1~1.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"pycrypto\", rpm:\"pycrypto~2.0.1~2.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"pycrypto\", rpm:\"pycrypto~2.0.1~3.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"pycrypto\", rpm:\"pycrypto~2.0~1.1.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2019-01-16T20:09:17", "bulletinFamily": "scanner", "description": "Missing checks for the key length in the ARC2 module potentially\nallowed attackers to crash applications using python-crypto or\npotentially even cause execute arbitrary code (CVE-2009-0544).", "modified": "2014-06-13T00:00:00", "published": "2009-05-08T00:00:00", "id": "SUSE_PYTHON-CRYPTO-6063.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=38713", "title": "openSUSE 10 Security Update : python-crypto (python-crypto-6063)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update python-crypto-6063.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(38713);\n script_version (\"$Revision: 1.5 $\");\n script_cvs_date(\"$Date: 2014/06/13 20:36:48 $\");\n\n script_cve_id(\"CVE-2009-0544\");\n\n script_name(english:\"openSUSE 10 Security Update : python-crypto (python-crypto-6063)\");\n script_summary(english:\"Check for the python-crypto-6063 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Missing checks for the key length in the ARC2 module potentially\nallowed attackers to crash applications using python-crypto or\npotentially even cause execute arbitrary code (CVE-2009-0544).\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected python-crypto package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python-crypto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:10.3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/03/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/05/08\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2014 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE10\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"10.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE10.3\", reference:\"python-crypto-2.0.1-103.2\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"python-crypto\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-01-16T20:08:55", "bulletinFamily": "scanner", "description": "The remote host is affected by the vulnerability described in GLSA-200903-11\n(PyCrypto: Execution of arbitrary code)\n\n Mike Wiacek of the Google Security Team reported a buffer overflow in\n the ARC2 module when processing a large ARC2 key length.\nImpact :\n\n A remote attacker could entice a user or automated system to decrypt an\n ARC2 stream in an application using PyCrypto, possibly resulting in the\n execution of arbitrary code or a Denial of Service.\nWorkaround :\n\n There is no known workaround at this time.", "modified": "2018-07-11T00:00:00", "published": "2009-03-10T00:00:00", "id": "GENTOO_GLSA-200903-11.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=35809", "title": "GLSA-200903-11 : PyCrypto: Execution of arbitrary code", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 200903-11.\n#\n# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(35809);\n script_version(\"1.13\");\n script_cvs_date(\"Date: 2018/07/11 17:09:25\");\n\n script_cve_id(\"CVE-2009-0544\");\n script_bugtraq_id(33674);\n script_xref(name:\"GLSA\", value:\"200903-11\");\n\n script_name(english:\"GLSA-200903-11 : PyCrypto: Execution of arbitrary code\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-200903-11\n(PyCrypto: Execution of arbitrary code)\n\n Mike Wiacek of the Google Security Team reported a buffer overflow in\n the ARC2 module when processing a large ARC2 key length.\n \nImpact :\n\n A remote attacker could entice a user or automated system to decrypt an\n ARC2 stream in an application using PyCrypto, possibly resulting in the\n execution of arbitrary code or a Denial of Service.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/200903-11\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All PyCrypto users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=dev-python/pycrypto-2.0.1-r8'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:pycrypto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/03/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/03/10\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"dev-python/pycrypto\", unaffected:make_list(\"ge 2.0.1-r8\"), vulnerable:make_list(\"lt 2.0.1-r8\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"PyCrypto\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-01-16T20:08:54", "bulletinFamily": "scanner", "description": "Mike Wiacek discovered that a buffer overflow in the ARC2\nimplementation of Python Crypto, a collection of cryptographic\nalgorithms and protocols for Python allows denial of service and\npotentially the execution of arbitrary code.", "modified": "2018-11-10T00:00:00", "published": "2009-02-26T00:00:00", "id": "DEBIAN_DSA-1726.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=35738", "title": "Debian DSA-1726-1 : python-crypto - buffer overflow", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-1726. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(35738);\n script_version(\"1.9\");\n script_cvs_date(\"Date: 2018/11/10 11:49:33\");\n\n script_cve_id(\"CVE-2009-0544\");\n script_xref(name:\"DSA\", value:\"1726\");\n\n script_name(english:\"Debian DSA-1726-1 : python-crypto - buffer overflow\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Mike Wiacek discovered that a buffer overflow in the ARC2\nimplementation of Python Crypto, a collection of cryptographic\nalgorithms and protocols for Python allows denial of service and\npotentially the execution of arbitrary code.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2009/dsa-1726\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the python-crypto package.\n\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.0.1+dfsg1-2.3+lenny0.\n\nDue to a technical limitation in the Debian archive management scripts\nthe update for the old stable distribution (etch) cannot be released\nsynchronously. It will be fixed in version 2.0.1+dfsg1-1.2+etch0 soon.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:python-crypto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/02/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/02/26\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"5.0\", prefix:\"python-crypto\", reference:\"2.0.1+dfsg1-2.3+lenny0\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"python-crypto-dbg\", reference:\"2.0.1+dfsg1-2.3+lenny0\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-01-16T20:09:10", "bulletinFamily": "scanner", "description": "Mike Wiacek discovered that the ARC2 implementation in Python Crypto\ndid not correctly check the key length. If a user or automated system\nwere tricked into processing a malicious ARC2 stream, a remote\nattacker could execute arbitrary code or crash the application using\nPython Crypto, leading to a denial of service.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "modified": "2018-11-28T00:00:00", "published": "2009-04-23T00:00:00", "id": "UBUNTU_USN-729-1.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=37504", "title": "Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : python-crypto vulnerability (USN-729-1)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-729-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(37504);\n script_version(\"1.12\");\n script_cvs_date(\"Date: 2018/11/28 22:47:45\");\n\n script_cve_id(\"CVE-2009-0544\");\n script_bugtraq_id(33674);\n script_xref(name:\"USN\", value:\"729-1\");\n\n script_name(english:\"Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : python-crypto vulnerability (USN-729-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Mike Wiacek discovered that the ARC2 implementation in Python Crypto\ndid not correctly check the key length. If a user or automated system\nwere tricked into processing a malicious ARC2 stream, a remote\nattacker could execute arbitrary code or crash the application using\nPython Crypto, leading to a denial of service.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/729-1/\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected python-crypto, python-crypto-dbg and / or\npython2.4-crypto packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:python-crypto\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:python-crypto-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:python2.4-crypto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:6.06:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:7.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:8.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:8.10\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/03/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/04/23\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2009-2018 Canonical, Inc. / NASL script (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! ereg(pattern:\"^(6\\.06|7\\.10|8\\.04|8\\.10)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 6.06 / 7.10 / 8.04 / 8.10\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"6.06\", pkgname:\"python-crypto\", pkgver:\"2.0.1+dfsg1-1ubuntu1.1\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"python2.4-crypto\", pkgver:\"2.0.1+dfsg1-1ubuntu1.1\")) flag++;\nif (ubuntu_check(osver:\"7.10\", pkgname:\"python-crypto\", pkgver:\"2.0.1+dfsg1-2ubuntu1.1\")) flag++;\nif (ubuntu_check(osver:\"7.10\", pkgname:\"python-crypto-dbg\", pkgver:\"2.0.1+dfsg1-2ubuntu1.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"python-crypto\", pkgver:\"2.0.1+dfsg1-2.1ubuntu1.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"python-crypto-dbg\", pkgver:\"2.0.1+dfsg1-2.1ubuntu1.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"python-crypto\", pkgver:\"2.0.1+dfsg1-2.3ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"python-crypto-dbg\", pkgver:\"2.0.1+dfsg1-2.3ubuntu0.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"python-crypto / python-crypto-dbg / python2.4-crypto\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-01-16T20:09:35", "bulletinFamily": "scanner", "description": "Missing checks for the key length in the ARC2 module potentially\nallowed attackers to crash applications using python-crypto or\npotentially even cause execute arbitrary code (CVE-2009-0544).", "modified": "2014-06-13T00:00:00", "published": "2009-07-21T00:00:00", "id": "SUSE_11_1_PYTHON-CRYPTO-090312.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=40301", "title": "openSUSE Security Update : python-crypto (python-crypto-589)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update python-crypto-589.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(40301);\n script_version(\"$Revision: 1.8 $\");\n script_cvs_date(\"$Date: 2014/06/13 19:55:05 $\");\n\n script_cve_id(\"CVE-2009-0544\");\n\n script_name(english:\"openSUSE Security Update : python-crypto (python-crypto-589)\");\n script_summary(english:\"Check for the python-crypto-589 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Missing checks for the key length in the ARC2 module potentially\nallowed attackers to crash applications using python-crypto or\npotentially even cause execute arbitrary code (CVE-2009-0544).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=483345\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected python-crypto package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python-crypto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:11.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/03/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/07/21\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2014 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE11\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"11.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE11.1\", reference:\"python-crypto-2.0.1-28.115.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"python-crypto\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-01-16T20:09:13", "bulletinFamily": "scanner", "description": "A vulnerability have been discovered and corrected in PyCrypto ARC2\nmodule 2.0.1, which allows remote attackers to cause a denial of\nservice and possibly execute arbitrary code via a large ARC2 key\nlength (CVE-2009-0544).\n\nThe updated packages have been patched to prevent this.\n\nUpdate :\n\nThe previous update package was not signed.", "modified": "2018-07-19T00:00:00", "published": "2009-04-23T00:00:00", "id": "MANDRIVA_MDVSA-2009-049.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=37927", "title": "Mandriva Linux Security Advisory : pycrypto (MDVSA-2009:049-1)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 70103\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2009:049. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(37927);\n script_version (\"1.12\");\n script_cvs_date(\"Date: 2018/07/19 20:59:16\");\n\n script_cve_id(\"CVE-2009-0544\");\n script_bugtraq_id(33674);\n script_xref(name:\"MDVSA\", value:\"2009:049-1\");\n\n script_name(english:\"Mandriva Linux Security Advisory : pycrypto (MDVSA-2009:049-1)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Mandriva Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A vulnerability have been discovered and corrected in PyCrypto ARC2\nmodule 2.0.1, which allows remote attackers to cause a denial of\nservice and possibly execute arbitrary code via a large ARC2 key\nlength (CVE-2009-0544).\n\nThe updated packages have been patched to prevent this.\n\nUpdate :\n\nThe previous update package was not signed.\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected pycrypto package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:pycrypto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2008.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2008.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2009.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/02/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/04/23\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2008.0\", reference:\"pycrypto-2.0.1-1.2mdv2008.0\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2008.1\", reference:\"pycrypto-2.0.1-2.2mdv2008.1\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2009.0\", reference:\"pycrypto-2.0.1-3.2mdv2009.0\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-01-16T20:09:15", "bulletinFamily": "scanner", "description": "A vulnerability have been discovered and corrected in PyCrypto ARC2\nmodule 2.0.1, which allows remote attackers to cause a denial of\nservice and possibly execute arbitrary code via a large ARC2 key\nlength (CVE-2009-0544).\n\nThe updated packages have been patched to prevent this.\n\nUpdate :\n\nThe previous update package was not signed.", "modified": "2018-07-19T00:00:00", "published": "2009-04-23T00:00:00", "id": "MANDRIVA_MDVSA-2009-050.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=38149", "title": "Mandriva Linux Security Advisory : python-pycrypto (MDVSA-2009:050-1)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 70103\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2009:050. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(38149);\n script_version (\"1.12\");\n script_cvs_date(\"Date: 2018/07/19 20:59:16\");\n\n script_cve_id(\"CVE-2009-0544\");\n script_bugtraq_id(33674);\n script_xref(name:\"MDVSA\", value:\"2009:050-1\");\n\n script_name(english:\"Mandriva Linux Security Advisory : python-pycrypto (MDVSA-2009:050-1)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Mandriva Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A vulnerability have been discovered and corrected in PyCrypto ARC2\nmodule 2.0.1, which allows remote attackers to cause a denial of\nservice and possibly execute arbitrary code via a large ARC2 key\nlength (CVE-2009-0544).\n\nThe updated packages have been patched to prevent this.\n\nUpdate :\n\nThe previous update package was not signed.\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected python-pycrypto package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:python-pycrypto\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2009.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/02/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/04/23\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2009.0\", reference:\"python-pycrypto-2.0.1-4.2mdv2009.0\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:29", "bulletinFamily": "software", "description": "\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n _______________________________________________________________________\r\n\r\n Mandriva Linux Security Advisory MDVSA-2009:050-1\r\n http://www.mandriva.com/security/\r\n _______________________________________________________________________\r\n\r\n Package : python-pycrypto\r\n Date : February 23, 2009\r\n Affected: 2009.0\r\n _______________________________________________________________________\r\n\r\n Problem Description:\r\n\r\n A vulnerability have been discovered and corrected in PyCrypto\r\n ARC2 module 2.0.1, which allows remote attackers to cause a denial\r\n of service and possibly execute arbitrary code via a large ARC2 key\r\n length (CVE-2009-0544).\r\n \r\n The updated packages have been patched to prevent this.\r\n\r\n Update:\r\n\r\n The previous update package was not signed.\r\n _______________________________________________________________________\r\n\r\n References:\r\n\r\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0544\r\n _______________________________________________________________________\r\n\r\n Updated Packages:\r\n\r\n Mandriva Linux 2009.0:\r\n e50d00d0c1a180f214ba9ad5d712e4e4 2009.0/i586/python-pycrypto-2.0.1-4.2mdv2009.0.i586.rpm \r\n 610275bf3bcc33e324cc42ea1a1e0021 2009.0/SRPMS/python-pycrypto-2.0.1-4.2mdv2009.0.src.rpm\r\n\r\n Mandriva Linux 2009.0/X86_64:\r\n 77071b620a3b193ddc50bcc7e60873be 2009.0/x86_64/python-pycrypto-2.0.1-4.2mdv2009.0.x86_64.rpm \r\n 610275bf3bcc33e324cc42ea1a1e0021 2009.0/SRPMS/python-pycrypto-2.0.1-4.2mdv2009.0.src.rpm\r\n _______________________________________________________________________\r\n\r\n To upgrade automatically use MandrivaUpdate or urpmi. The verification\r\n of md5 checksums and GPG signatures is performed automatically for you.\r\n\r\n All packages are signed by Mandriva for security. You can obtain the\r\n GPG public key of the Mandriva Security Team by executing:\r\n\r\n gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\r\n\r\n You can view other update advisories for Mandriva Linux at:\r\n\r\n http://www.mandriva.com/security/advisories\r\n\r\n If you want to report vulnerabilities, please contact\r\n\r\n security_(at)_mandriva.com\r\n _______________________________________________________________________\r\n\r\n Type Bits/KeyID Date User ID\r\n pub 1024D/22458A98 2000-07-10 Mandriva Security Team\r\n <security*mandriva.com>\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.9 (GNU/Linux)\r\n\r\niD8DBQFJotS4mqjQ0CJFipgRApphAJ93bx8hHgq9sqP9Kif8yIf5dBB4jQCfTdF9\r\nEGojZQaxyi5w7NSFtX29qFA=\r\n=IOaM\r\n-----END PGP SIGNATURE-----", "modified": "2009-02-25T00:00:00", "published": "2009-02-25T00:00:00", "id": "SECURITYVULNS:DOC:21382", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:21382", "title": "[ MDVSA-2009:050-1 ] python-pycrypto", "type": "securityvulns", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:09:32", "bulletinFamily": "software", "description": "DoS on ARC2 key processing", "modified": "2009-02-25T00:00:00", "published": "2009-02-25T00:00:00", "id": "SECURITYVULNS:VULN:9690", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:9690", "title": "PyCrypto python module DoS", "type": "securityvulns", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "debian": [{"lastseen": "2018-10-16T22:15:08", "bulletinFamily": "unix", "description": "- ------------------------------------------------------------------------\nDebian Security Advisory DSA-1726-1 security@debian.org\nhttp://www.debian.org/security/ Moritz Muehlenhoff\nFebruary 25, 2009 http://www.debian.org/security/faq\n- ------------------------------------------------------------------------\n\nPackage : python-crypto\nVulnerability : buffer overflow\nProblem type : local(remote)\nDebian-specific: no\nCVE Id(s) : CVE-2009-0544\n\nMike Wiacek discovered that a buffer overflow in the ARC2 implementation\nof Python Crypto, a collection of cryptographic algorithms and protocols\nfor Python allows denial of service and potentially the execution of\narbitrary code.\n\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.0.1+dfsg1-2.3+lenny0.\n\nDue to a technical limitation in the Debian archive management scripts\nthe update for the old stable distribution (etch) cannot be released\nsynchronously. It will be fixed in version 2.0.1+dfsg1-1.2+etch0 soon.\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your python-crypto package.\n\nUpgrade instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file.\n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration.\n\n\nDebian GNU/Linux 5.0 alias lenny\n- --------------------------------\n\nStable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.\n\nSource archives:\n\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto_2.0.1+dfsg1-2.3+lenny0.diff.gz\n Size/MD5 checksum: 10119 1bcc8b9ca25adb5442612ecb08a87773\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto_2.0.1+dfsg1.orig.tar.gz\n Size/MD5 checksum: 158593 f81d94a506981c67188f08057d797420\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto_2.0.1+dfsg1-2.3+lenny0.dsc\n Size/MD5 checksum: 1294 1f0b48e12f296ba99bfa8da9fa362cb4\n\nalpha architecture (DEC Alpha)\n\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto-dbg_2.0.1+dfsg1-2.3+lenny0_alpha.deb\n Size/MD5 checksum: 627788 631e1ea5e7f73d59ab07c3986434f11f\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto_2.0.1+dfsg1-2.3+lenny0_alpha.deb\n Size/MD5 checksum: 266176 9c551d2d4a85f90f33ec715df3eeb584\n\namd64 architecture (AMD x86_64 (AMD64))\n\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto-dbg_2.0.1+dfsg1-2.3+lenny0_amd64.deb\n Size/MD5 checksum: 572068 ef452cdbc44fa2dd5565c5a3913cf957\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto_2.0.1+dfsg1-2.3+lenny0_amd64.deb\n Size/MD5 checksum: 245640 f79d0401a21ebde70268367435462e84\n\narm architecture (ARM)\n\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto-dbg_2.0.1+dfsg1-2.3+lenny0_arm.deb\n Size/MD5 checksum: 544928 d354bb116a8346aa92405e288bd323eb\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto_2.0.1+dfsg1-2.3+lenny0_arm.deb\n Size/MD5 checksum: 235126 55b4ef5994132145f6d17d51076d0351\n\narmel architecture (ARM EABI)\n\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto-dbg_2.0.1+dfsg1-2.3+lenny0_armel.deb\n Size/MD5 checksum: 544874 a03c5dbbcb16b8ab554010547806fc3d\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto_2.0.1+dfsg1-2.3+lenny0_armel.deb\n Size/MD5 checksum: 230526 71356ee6ddb8be712b909aaaea1f5f48\n\ni386 architecture (Intel ia32)\n\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto-dbg_2.0.1+dfsg1-2.3+lenny0_i386.deb\n Size/MD5 checksum: 520136 d8be00fbefb8abaf7603708852014947\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto_2.0.1+dfsg1-2.3+lenny0_i386.deb\n Size/MD5 checksum: 225730 3c36d456175771351141a5e5f9494308\n\nia64 architecture (Intel ia64)\n\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto_2.0.1+dfsg1-2.3+lenny0_ia64.deb\n Size/MD5 checksum: 339162 e7d63ed452443707c7e482d612bccb65\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto-dbg_2.0.1+dfsg1-2.3+lenny0_ia64.deb\n Size/MD5 checksum: 669298 ee288f0fe63f2f952336f9272732579a\n\nmips architecture (MIPS (Big Endian))\n\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto_2.0.1+dfsg1-2.3+lenny0_mips.deb\n Size/MD5 checksum: 227878 51faa12fe32052d6bd9d8f5eb2e5612d\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto-dbg_2.0.1+dfsg1-2.3+lenny0_mips.deb\n Size/MD5 checksum: 545022 7ec73b47a01bd75460a9ea8afbee8892\n\nmipsel architecture (MIPS (Little Endian))\n\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto_2.0.1+dfsg1-2.3+lenny0_mipsel.deb\n Size/MD5 checksum: 226694 c47c31f8091a3759ca032211fd8f606b\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto-dbg_2.0.1+dfsg1-2.3+lenny0_mipsel.deb\n Size/MD5 checksum: 540456 ceea7cce9a95487f7d538854dbfbd0a6\n\npowerpc architecture (PowerPC)\n\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto_2.0.1+dfsg1-2.3+lenny0_powerpc.deb\n Size/MD5 checksum: 264798 ea753acccc457266739ed3e4b38dab9c\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto-dbg_2.0.1+dfsg1-2.3+lenny0_powerpc.deb\n Size/MD5 checksum: 674786 0734263a3974af01562d5c2107787eed\n\ns390 architecture (IBM S/390)\n\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto_2.0.1+dfsg1-2.3+lenny0_s390.deb\n Size/MD5 checksum: 234282 9ce5e55881a826ccaffc1ffb7bd2e60e\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto-dbg_2.0.1+dfsg1-2.3+lenny0_s390.deb\n Size/MD5 checksum: 541262 6756b41a086e615dd5bdb864e4274dae\n\nsparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto_2.0.1+dfsg1-2.3+lenny0_sparc.deb\n Size/MD5 checksum: 230684 37fc20c2e65c3fe273aac05e76a72789\n http://security.debian.org/pool/updates/main/p/python-crypto/python-crypto-dbg_2.0.1+dfsg1-2.3+lenny0_sparc.de\n Size/MD5 checksum: 510644 486f3ffd9ee9385eae475580be4fba17\n\n\n These files will probably be moved into the stable distribution on\n its next update.\n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>\n", "modified": "2009-02-25T20:32:24", "published": "2009-02-25T20:32:24", "id": "DEBIAN:DSA-1726-1:B28ED", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2009/msg00035.html", "title": "[SECURITY] [DSA 1726-1] New python-crypto packages fix denial of service", "type": "debian", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "ubuntu": [{"lastseen": "2018-08-31T00:09:55", "bulletinFamily": "unix", "description": "Mike Wiacek discovered that the ARC2 implementation in Python Crypto did not correctly check the key length. If a user or automated system were tricked into processing a malicious ARC2 stream, a remote attacker could execute arbitrary code or crash the application using Python Crypto, leading to a denial of service.", "modified": "2009-03-05T00:00:00", "published": "2009-03-05T00:00:00", "id": "USN-729-1", "href": "https://usn.ubuntu.com/729-1/", "title": "Python Crypto vulnerability", "type": "ubuntu", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "seebug": [{"lastseen": "2017-11-19T19:02:21", "bulletinFamily": "exploit", "description": "BUGTRAQ ID: 33674\r\nCVE(CAN) ID: CVE-2009-0544\r\n\r\nPyCrypto\u662f\u4f7f\u7528Python\u7f16\u5199\u7684\u52a0\u5bc6\u5de5\u5177\u5305\u3002\r\n\r\nPyCrypto\u7684ARC2\u6a21\u5757\u4e2d\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u5982\u679c\u8fdc\u7a0b\u653b\u51fb\u8005\u5728\u53d1\u9001\u7684\u8bf7\u6c42\u4e2d\u5305\u542b\u6709\u8d85\u957f\u7684ARC2\u5bc6\u94a5\u957f\u5ea6\u7684\u8bdd\uff0c\u5c31\u53ef\u4ee5\u89e6\u53d1\u8fd9\u4e2a\u6ea2\u51fa\uff0c\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u6216\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002\n\nDwayne C. Litzenberger PyCrypto 2.0.x\n \u5382\u5546\u8865\u4e01\uff1a\r\n\r\nDwayne C. Litzenberger\r\n----------------------\r\n\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\n\r\n<a href=http://gitweb2.dlitz.net/?p=crypto/pycrypto-2.x.git;a=commitdiff;h=d1c4875e1f220652fe7ff8358f56dee3b2aba31b target=_blank rel=external nofollow>http://gitweb2.dlitz.net/?p=crypto/pycrypto-2.x.git;a=commitdiff;h=d1c4875e1f220652fe7ff8358f56dee3b2aba31b</a>", "modified": "2009-02-19T00:00:00", "published": "2009-02-19T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-4798", "id": "SSV:4798", "type": "seebug", "title": "PyCrypto ARC2\u6a21\u5757\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e", "sourceData": "\n http://gitweb2.dlitz.net/?p=crypto/pycrypto-2.x.git;a=blob;f=SelfTest/Cipher/test_ARC2.py;h=84d42410\r\n\n ", "sourceHref": "https://www.seebug.org/vuldb/ssvid-4798", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:39", "bulletinFamily": "unix", "description": "### Background\n\nPyCrypto is the Python Cryptography Toolkit. \n\n### Description\n\nMike Wiacek of the Google Security Team reported a buffer overflow in the ARC2 module when processing a large ARC2 key length. \n\n### Impact\n\nA remote attacker could entice a user or automated system to decrypt an ARC2 stream in an application using PyCrypto, possibly resulting in the execution of arbitrary code or a Denial of Service. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll PyCrypto users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-python/pycrypto-2.0.1-r8\"", "modified": "2009-03-09T00:00:00", "published": "2009-03-09T00:00:00", "id": "GLSA-200903-11", "href": "https://security.gentoo.org/glsa/200903-11", "type": "gentoo", "title": "PyCrypto: Execution of arbitrary code", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}