Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 523
Alerts This Week
Warning Icon 1 523

Ubuntu: 11.10, 11.04, 10.04 LTS Critical: Python 2.6 Denial Of Service

ubuntu
Calendar Grey October 4, 2012
Scroller Ubuntu
Critical security issues in Python 2.6 for Ubuntu addressed. Updates, exploits and resolutions provided.
Several security issues were fixed in Python 2.6.

Summary

Several security issues were fixed in Python 2.6.

Software Description:

- python2.6: An interactive high-level object-oriented language

Details:

It was discovered that Python would prepend an empty string to sys.path

under certain circumstances. A local attacker with write access to the

current working directory could exploit this to execute arbitrary code.

(CVE-2008-5983)

It was discovered that the audioop module did not correctly perform input

validation. If a user or automatated system were tricked into opening a

crafted audio file, an attacker could cause a denial of service via

application crash. (CVE-2010-1634, CVE-2010-2089)

Giampaolo Rodola discovered several race conditions in the smtpd module.

A remote attacker could exploit this to cause a denial of service via

daemon outage. (CVE-2010-3493)

It was discovered that the CGIHTTPServer module did properly perform

input validation on certain HTTP GET requests. A remote attacker could

potentially ...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service remote execution ubuntu python python fix

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  python2.6                       2.6.7-4ubuntu1.1
  python2.6-minimal               2.6.7-4ubuntu1.1

Ubuntu 11.04:
  python2.6                       2.6.6-6ubuntu7.1
  python2.6-minimal               2.6.6-6ubuntu7.1

Ubuntu 10.04 LTS:
  python2.6                       2.6.5-1ubuntu6.1
  python2.6-minimal               2.6.5-1ubuntu6.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1596-1

CVE-2008-5983, CVE-2010-1634, CVE-2010-2089, CVE-2010-3493,

CVE-2011-1015, CVE-2011-1521, CVE-2011-4940, CVE-2011-4944,

CVE-2012-0845, CVE-2012-1150

Severity
critical
Lowest
Low
Medium
High
Critical

=========================================================================Ubuntu Security Notice USN-1596-1

Topics%20covered

Topics Covered

security advisory denial of service remote execution ubuntu python python fix

Package Information

https://launchpad.net/ubuntu/+source/python2.6/2.6.7-4ubuntu1.1
https://launchpad.net/ubuntu/+source/python2.6/2.6.6-6ubuntu7.1
https://launchpad.net/ubuntu/+source/python2.6/2.6.5-1ubuntu6.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.