PT-2006-2543 · Python · Python

Dx/Vaxen + 1 · Published 2006-03-30 · Updated 2023-08-02 · CVE-2006-1542

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Python versions 2.4.2 and earlier

Description: A stack-based buffer overflow issue allows local users to cause a stack overflow, and possibly gain privileges, by running a script from a current working directory with a long name. This is related to the realpath function. The impact of this issue might be limited due to the potential need for the attacker to already have certain privileges to place an exploitable program in a directory with a long name. However, setuid applications might be affected, depending on how Python determines the current working directory.

Recommendations: For Python versions 2.4.2 and earlier, consider updating to a newer version to mitigate the risk, although the exact fix version is not specified. As a temporary workaround, consider avoiding the use of long names for directories from which scripts are run, to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-1542

RHSA-2008:0264

RHSA-2008:0525

RHSA-2008:0629

Affected Products

Python

References · 6

• 🔥 https://exploit-db.com/exploits/1591 · Exploit
• 🔥 http://gotfault.net/research/exploit/gexp-python.py · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1542 · Security Note
• http://redhat.com/support/errata/RHSA-2008-0629.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1542 · Note
• http://secunia.com/advisories/31492 · Note