PT-2009-3194 · Pycrypto · Pycrypto

Steven M. Christey · Publicado 2009-02-12 · Atualizado 2017-08-08 · CVE-2009-0544

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PyCrypto version 2.0.1

Description A buffer overflow issue in the ARC2 module allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large ARC2 key length.

Recommendations For PyCrypto version 2.0.1, consider updating to a newer version that addresses this issue, as using a large ARC2 key length could lead to a denial of service or arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2009-0544

DSA-1726-1

Produtos afetados

Pycrypto

Referências · 16

• 🔥 http://gitweb2.dlitz.net/?p=crypto/pycrypto-2.x.git;a=commitdiff;h=fd73731dfad451a81056fbb01e09aa78ab82eb5d · Exploit
• 🔥 http://securityfocus.com/bid/33674 · Exploit
• 🔥 http://gitweb2.dlitz.net/?p=crypto/pycrypto-2.x.git;a=commitdiff;h=d1c4875e1f220652fe7ff8358f56dee3b2aba31b · Exploit
• 🔥 https://exploit-db.com/exploits/32780 · Exploit
• http://gitweb2.dlitz.net/?p=crypto/pycrypto-2.x.git%3Ba=commitdiff%3Bh=d1c4875e1f220652fe7ff8358f56dee3b2aba31b · Nota
• http://gitweb2.dlitz.net/?p=crypto/pycrypto-2.x.git%3Ba=commitdiff%3Bh=fd73731dfad451a81056fbb01e09aa78ab82eb5d · Nota
• http://secunia.com/advisories/35065 · Nota
• http://secunia.com/advisories/34199 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2009:049 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2009/02/12/5 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48617 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0544 · Nota de Segurança
• http://mandriva.com/security/advisories?name=MDVSA-2009:050 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Aviso do Fabricante
• http://gentoo.org/security/en/glsa/glsa-200903-11.xml · Aviso do Fabricante