PT-2005-1198 · Python+1 · Simplexmlrpcserver+2

Guido Van Rossum · Published 2005-02-06 · Updated 2023-08-02 · CVE-2005-0089

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Python versions 2.2, 2.3 before 2.3.5, and 2.4

Description The issue allows remote attackers to read or modify globals of the associated module, and possibly execute arbitrary code, via dotted attributes, when the SimpleXMLRPCServer library module is used by XML-RPC servers that register an object without a dispatch method.

Recommendations For Python version 2.2, update to a version with the necessary security fixes. For Python version 2.3 before 2.3.5, update to version 2.3.5 or later. For Python version 2.4, consider disabling the use of the register instance method without a dispatch method until a patch is available.

Fix

Related Identifiers

CVE-2005-0089

DSA-666-1

RHSA-2005:108

RHSA-2005:109

RHSA-2005_108

RHSA-2005_109

Affected Products

Python

Red Hat

Simplexmlrpcserver

References · 17

• http://trustix.org/errata/2005/0003 · Vendor Advisory
• http://python.org/security/PSF-2005-001/patch-2.2.txt · Patch
• http://mandriva.com/security/advisories?name=MDKSA-2005:035 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-108.html · Vendor Advisory
• http://python.org/security/PSF-2005-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0089 · Security Note
• http://marc.info/?l=bugtraq&m=110746469728728&w=2 · Note
• https://rhn.redhat.com/errata/RHSA-2005-108.html · Note
• http://secunia.com/advisories/14128 · Note
• http://debian.org/security/2005/dsa-666 · Patch, Vendor Advisory
• http://securityfocus.com/bid/12437 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19217 · Note
• http://securitytracker.com/id?1013083 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9811 · Note
• https://redhat.com/security/data/cve/CVE-2005-0089.html · Note