Python PyLocale_strxfrm函数远程信息泄露漏洞

2008-04-2300:00:00

Root

www.seebug.org

0.02 Low

EPSS

Percentile

87.6%

JSON

BUGTRAQ ID: 23887
CVE(CAN) ID: CVE-2007-2052

Python是一种开放源代码的脚本编程语言。

Python的Modules/_localemodule.c文件中的PyLocale_strxfrm函数中存在单字节溢出漏洞，允许攻击者读取部分内存内容。

Modules/_localemodule.c:361
356 n1 = strlen(s) + 1;
357 buf = PyMem_Malloc(n1);
358 if (!buf)
359 return PyErr_NoMemory();
360 n2 = strxfrm(buf, s, n1);

如果所转换的字符串长于原始字符串的话：

361 if (n2 > n1) {
362 /* more space needed */

在这里会分配n2字节：

363 buf = PyMem_Realloc(buf, n2);
364 if (!buf)
365 return PyErr_NoMemory();

字符串会为n2字符长，终止的空字符不适合这个长度，因此字符串不会终止，在某些情况下可能导致信息泄露。

366 strxfrm(buf, s, n2);
367 }
368 result = PyString_FromString(buf);
369 PyMem_Free(buf);
370 return result;
371 }
372
373 #if defined(MS_WINDOWS)
374 static PyObject*
375 PyLocale_getdefaultlocale(PyObject* self)

Python Software Foundation Python 2.5
Python Software Foundation Python 2.4
厂商补丁：

Debian

Debian已经为此发布了一个安全公告（DSA-1551-1）以及相应补丁:
DSA-1551-1：New python2.4 packages fix several vulnerabilities
链接：<a href=“http://www.debian.org/security/2008/dsa-1551” target=“_blank”>http://www.debian.org/security/2008/dsa-1551</a>

补丁下载：

Source archives:

<a href=“http://security.debian.org/pool/updates/main/p/python2.4/python2.4_2.4.4-3+etch1.diff.gz” target=“_blank”>http://security.debian.org/pool/updates/main/p/python2.4/python2.4_2.4.4-3+etch1.diff.gz</a>
Size/MD5 checksum: 195434 8b86b3dc4c5a86a9ad8682fee56f30ca
<a href=“http://security.debian.org/pool/updates/main/p/python2.4/python2.4_2.4.4.orig.tar.gz” target=“_blank”>http://security.debian.org/pool/updates/main/p/python2.4/python2.4_2.4.4.orig.tar.gz</a>
Size/MD5 checksum: 9508940 f74ef9de91918f8927e75e8c3024263a
<a href=“http://security.debian.org/pool/updates/main/p/python2.4/python2.4_2.4.4-3+etch1.dsc” target=“_blank”>http://security.debian.org/pool/updates/main/p/python2.4/python2.4_2.4.4-3+etch1.dsc</a>
Size/MD5 checksum: 1201 585773fd24634e05bb56b8cc85215c65

Architecture independent packages:

<a href=“http://security.debian.org/pool/updates/main/p/python2.4/python2.4-examples_2.4.4-3+etch1_all.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/python2.4/python2.4-examples_2.4.4-3+etch1_all.deb</a>
Size/MD5 checksum: 589642 63092c4cd1ea78c0993345be25a162b8
<a href=“http://security.debian.org/pool/updates/main/p/python2.4/idle-python2.4_2.4.4-3+etch1_all.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/python2.4/idle-python2.4_2.4.4-3+etch1_all.deb</a>
Size/MD5 checksum: 60864 21664a3f029087144046b6c175e88736

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

补丁安装方法：

手工安装补丁包：

首先，使用下面的命令来下载补丁软件：

wget url (url是补丁下载链接地址)

然后，使用下面的命令来安装补丁：

dpkg -i file.deb (file是相应的补丁名)

使用apt-get自动安装补丁包：

首先，使用下面的命令更新内部数据库：

apt-get update

然后，使用下面的命令安装更新软件包：

apt-get upgrade

RedHat

RedHat已经为此发布了一个安全公告（RHSA-2007:1077-01）以及相应补丁:
RHSA-2007:1077-01：Moderate: python security update
链接：<a href=“https://www.redhat.com/support/errata/RHSA-2007-1077.html” target=“_blank”>https://www.redhat.com/support/errata/RHSA-2007-1077.html</a>

Python Software Foundation

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

<a href=“http://svn.python.org/view/python/branches/release25-maint/Modules/_localemodule.c?rev=54670&r1=51333&r2=54670” target=“_blank”>http://svn.python.org/view/python/branches/release25-maint/Modules/_localemodule.c?rev=54670&r1=51333&r2=54670</a>


                                                #!/usr/bin/python

import&nbsp;locale

print&nbsp;locale.setlocale(locale.LC_COLLATE,&nbsp;'pl_PL.UTF8')
print&nbsp;repr(locale.strxfrm('a'))