Executive Summary
| Summary | |
|---|---|
| Title | New Python2.2 packages fix unauthorised XML-RPC internals access |
| Informations | |||
|---|---|---|---|
| Name | DSA-666 | First vendor Publication | 2005-02-04 |
| Vendor | Debian | Last vendor Modification | 2005-02-04 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The Python development team has discovered a flaw in their language packge. The SimpleXMLRPCServer library module could permit remote attackers unintended access to internals of the registered object or its module or possibly other modules. The flaw only affects Python XML-RPC servers that use the register_instance() method to register an object without a _dispatch() method. Servers using only register_function() are not affected. For the stable distribution (woody) this problem has been fixed in version 2.2.1-4.7. No other version of Python in woody is affected. For the testing (sarge) and unstable (sid) distributions the following matrix explains which version will contain the correction in which version: testing unstable Python 2.2 2.2.3-14 2.2.3-14 Python 2.3 2.3.4-20 2.3.4+2.3.5c1-2 Python 2.4 2.4-5 2.4-5 We recommend that you upgrade your Python packages. |
Original Source
| Url : http://www.debian.org/security/2005/dsa-666 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:9811 | |||
| Oval ID: | oval:org.mitre.oval:def:9811 | ||
| Title: | Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested, malformed multipart MIME messages that exhaust the stack during the recursive mime8to7 function for performing 8-bit to 7-bit conversion, which prevents Sendmail from delivering queued messages and might lead to disk consumption by core dump files. | ||
| Description: | The SimpleXMLRPCServer library module in Python 2.2, 2.3 before 2.3.5, and 2.4, when used by XML-RPC servers that use the register_instance method to register an object without a _dispatch method, allows remote attackers to read or modify globals of the associated module, and possibly execute arbitrary code, via dotted attributes. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0089 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for python File : nvt/sles9p5014447.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200502-09 (Python) File : nvt/glsa_200502_09.nasl |
| 2008-09-04 | Name : FreeBSD Ports: python, python23, python22, python-devel File : nvt/freebsd_python.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 666-1 (python2.2) File : nvt/deb_666_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 13468 | Python SimpleXMLRPCServer Library Module Registered Object Access |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2006-01-15 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-73-1.nasl - Type : ACT_GATHER_INFO |
| 2005-07-13 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_6afa87d3764b11d9b0e70000e249a0a2.nasl - Type : ACT_GATHER_INFO |
| 2005-02-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-108.nasl - Type : ACT_GATHER_INFO |
| 2005-02-14 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200502-09.nasl - Type : ACT_GATHER_INFO |
| 2005-02-14 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-109.nasl - Type : ACT_GATHER_INFO |
| 2005-02-11 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-035.nasl - Type : ACT_GATHER_INFO |
| 2005-02-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-666.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:33:51 |
|
