Ubuntu: 2125-1 Critical: Python Denial Of Service From Network Traffic

ubuntu

March 3, 2014

Python could be made to crash or run programs if it received specially crafted network traffic.

Summary

Python could be made to crash or run programs if it received specially

crafted network traffic.

Software Description:

- python2.7: An interactive high-level object-oriented language

- python3.3: An interactive high-level object-oriented language

- python3.2: An interactive high-level object-oriented language

- python2.6: An interactive high-level object-oriented language

Details:

Ryan Smith-Roberts discovered that Python incorrectly handled buffer sizes

when using the socket.recvfrom_into() function. An attacker could possibly

use this issue to cause Python to crash, resulting in denial of service, or

possibly execute arbitrary code.

Topics Covered

security advisory denial of service security issue update network traffic ubuntu python

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  python2.7                       2.7.5-8ubuntu3.1
  python2.7-minimal               2.7.5-8ubuntu3.1
  python3.3                       3.3.2-7ubuntu3.1
  python3.3-minimal               3.3.2-7ubuntu3.1

Ubuntu 12.10:
  python2.7                       2.7.3-5ubuntu4.4
  python2.7-minimal               2.7.3-5ubuntu4.4
  python3.2                       3.2.3-6ubuntu3.5
  python3.2-minimal               3.2.3-6ubuntu3.5
  python3.3                       3.3.0-1ubuntu0.2
  python3.3-minimal               3.3.0-1ubuntu0.2

Ubuntu 12.04 LTS:
  python2.7                       2.7.3-0ubuntu3.5
  python2.7-minimal               2.7.3-0ubuntu3.5
  python3.2                       3.2.3-0ubuntu3.6
  python3.2-minimal               3.2.3-0ubuntu3.6

Ubuntu 10.04 LTS:
  python2.6                       2.6.5-1ubuntu6.3
  python2.6-minimal               2.6.5-1ubuntu6.3

In general, a standard system update will make all the necessary changes.