OSVDB ID: 4172

Title: Python IPv6 DNS Address Response Handling Overflow

Info

Disclosure
Mar 10, 2004

Discovery
Mar 09, 2004

Dates

Exploit
Unknown

Solution
Unknown

Description

 A remote overflow exists in the getaddrinfo() function in Python. Python fails to handle an IPv6 DNS address, if IPv6 is not enabled, resulting in a buffer overflow. With a specially crafted request, an attacker can cause arbitrary code to be executed on the vulnerable server.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity, Impact Unknown
Exploit: Exploit Rumored
Disclosure: OSVDB Verified

Solution

 Upgrade to version 2.2.2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Python Software Foundation

Python

 2.2
2.2.1

References

Credit
  • Sebastian Krahmer - krahmersuse.de - SuSE


Direct URL: http://osvdb.org/4172