Executive Summary
| Summary | |
|---|---|
| Title | python security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2005:108 | First vendor Publication | 2005-02-15 |
| Vendor | RedHat | Last vendor Modification | 2005-02-15 |
| Severity (Vendor) | Important | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated Python packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: Python is an interpreted, interactive, object-oriented programming language. An object traversal bug was found in the Python SimpleXMLRPCServer. This bug could allow a remote untrusted user to do unrestricted object traversal and allow them to access or change function internals using the im_* and func_* attributes. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0089 to this issue. Users of Python are advised to upgrade to these updated packages, which contain backported patches to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/ 5. Bug IDs fixed (http://bugzilla.redhat.com/): 146649 - CAN-2005-0089 python SimpleXMLRPCServer security issue |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2005-108.html |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:9811 | |||
| Oval ID: | oval:org.mitre.oval:def:9811 | ||
| Title: | Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested, malformed multipart MIME messages that exhaust the stack during the recursive mime8to7 function for performing 8-bit to 7-bit conversion, which prevents Sendmail from delivering queued messages and might lead to disk consumption by core dump files. | ||
| Description: | The SimpleXMLRPCServer library module in Python 2.2, 2.3 before 2.3.5, and 2.4, when used by XML-RPC servers that use the register_instance method to register an object without a _dispatch method, allows remote attackers to read or modify globals of the associated module, and possibly execute arbitrary code, via dotted attributes. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0089 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for python File : nvt/sles9p5014447.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200502-09 (Python) File : nvt/glsa_200502_09.nasl |
| 2008-09-04 | Name : FreeBSD Ports: python, python23, python22, python-devel File : nvt/freebsd_python.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 666-1 (python2.2) File : nvt/deb_666_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 13468 | Python SimpleXMLRPCServer Library Module Registered Object Access |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2006-01-15 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-73-1.nasl - Type : ACT_GATHER_INFO |
| 2005-07-13 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_6afa87d3764b11d9b0e70000e249a0a2.nasl - Type : ACT_GATHER_INFO |
| 2005-02-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-108.nasl - Type : ACT_GATHER_INFO |
| 2005-02-14 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200502-09.nasl - Type : ACT_GATHER_INFO |
| 2005-02-14 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-109.nasl - Type : ACT_GATHER_INFO |
| 2005-02-11 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-035.nasl - Type : ACT_GATHER_INFO |
| 2005-02-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-666.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:49:02 |
|
