oss-security - Re: CVE request - Python string expandtabs

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [month] [year] [list]

Date: Mon, 10 Nov 2008 09:17:51 -0600
From: "Will Drewry" <redpig@...rt.org>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...re.org>, 
	"Chris Evans" <scarybeasts@...il.com>
Subject: Re: CVE request - Python string expandtabs

On Mon, Nov 10, 2008 at 3:54 AM, Jan Lieskovsky <jlieskov@...hat.com> wrote:
> Hello Steve,
>
>  could you allocate a new CVE id for the following Python issue:
>
> * Advisory: http://scary.beasts.org/security/CESA-2008-008.html
>
> * Issue: Integer overflow in string expandtabs operation
>
> * PoC: s = 't\tt\t'
>       str.expandtabs(s, 2147483647)
>
>  Different issue than CVE-2008-2315 (CVE-2008-2315 mentions
>  patch: http://bugs.gentoo.org/attachment.cgi?id=159418&action=view
>  which is not sufficient to resolve this str_expandtabs issue).
>
> * Confirmation from Chris Evans:
>
>  Adding in Will....
>
>  ... yes, this sounds accurate. Searching through my mail, my colleague
>  Will found that the original expandtabs() fix was insufficient (thanks
>  for the catch Will!).
>
> * Upstream patch: http://svn.python.org/view?rev=61350&view=rev

This appears to be the patch for 2.6.  The 2.5 maintenance patch was
one revision earlier:
  http://svn.python.org/view?rev=61349&view=rev

> * Affected Python versions: 2.2.3 <= x <= 2.5.1

Given that there is a patch for 2.6 as well, it might be worth
expanding the impacted versions to include it.  (I believe 2.5.2 was
also affected where r61349 fixed it for 2.5.3.)

For patch validation purposes,
* string poc:
s = 'AA\t\n\tAAAAAAAA'
len(s.expandtabs(0x7ffffffe))

* unicode poc:
s = u'AA\t\n\tAAAAAAAA'
len(s.expandtabs(0x7ffffffe))


cheers, will

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.