Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 11.10 & 11.04: USN-1592-1 Moderate: Python 2.7 Denial of Service

ubuntu
Calendar Grey October 2, 2012
Scroller Ubuntu
Ubuntu Security Notice USN-1593-1 outlines vulnerabilities in Python 3.8. Multiple concerns have been addressed impacting various distributions.
Several security issues were fixed in Python 2.7.

Summary

Several security issues were fixed in Python 2.7.

Software Description:

- python2.7: An interactive high-level object-oriented language

(version 2.7)

Details:

Niels Heinen discovered that the urllib and urllib2 modules would

process Location headers that specify a redirection to file: URLs. A

remote attacker could exploit this to obtain sensitive information or

cause a denial of service. This issue only affected Ubuntu 11.04.

(CVE-2011-1521)

It was discovered that SimpleHTTPServer did not use a charset parameter

in the Content-Type HTTP header. An attacker could potentially exploit

this to conduct cross-site scripting (XSS) attacks against Internet

Explorer 7 users. This issue only affected Ubuntu 11.04. (CVE-2011-4940)

It was discovered that Python distutils contained a race condition when

creating the ~/.pypirc file. A local attacker could exploit this to

obtain sensitive information. (CVE-2011-4944)

It was discovered that SimpleXMLRPCServer did no...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service security issue software update cross-site scripting Ubuntu Python

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  python2.7                       2.7.2-5ubuntu1.1
  python2.7-minimal               2.7.2-5ubuntu1.1

Ubuntu 11.04:
  python2.7                       2.7.1-5ubuntu2.2
  python2.7-minimal               2.7.1-5ubuntu2.2

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1592-1

CVE-2011-1521, CVE-2011-4940, CVE-2011-4944, CVE-2012-0845,

CVE-2012-1150

October 02, 2012

Topics%20covered

Topics Covered

security advisory denial of service security issue software update cross-site scripting Ubuntu Python

Package Information

https://launchpad.net/ubuntu/+source/python2.7/2.7.2-5ubuntu1.1
https://launchpad.net/ubuntu/+source/python2.7/2.7.1-5ubuntu2.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.