PT-2010-4861 · Python+1 · Python+1
Jan Lieskovsky
·
Published
2010-10-19
·
Updated
2019-10-25
·
CVE-2010-3493
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Python versions 2.6 through 3.2 alpha
Description
The issue is related to multiple race conditions in the smtpd.py module, allowing remote attackers to cause a denial of service by establishing and immediately closing a TCP connection. This leads to unexpected return values or errors in the
accept function, such as None for the address, or ECONNABORTED, EAGAIN, or EWOULDBLOCK errors, or an ENOTCONN error in the getpeername function.Recommendations
For Python versions 2.6 through 3.2 alpha, consider disabling the smtpd module until a patch is available to prevent exploitation of this issue. Restrict access to the smtpd.py module to minimize the risk of denial of service attacks. Avoid using the
accept and getpeername functions in the affected module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Python
Red Hat