Python ImageOP模块多个整数溢出漏洞

<a href="https://www.exploit-db.com/exploits/30592" target="_blank">https://www.exploit-db.com/exploits/30592</a><br/> <a href="https://www.securityfocus.com/bid/25696" target="_blank">https://www.securityfocus.com/bid/25696</a><br/> <a href="http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200709-255" target="_blank">http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200709-255</a><br/>

ython是一种开放源代码的脚本编程语言。Python的imageop模块实现上存在堆溢出漏洞，本地攻击者可能利用此漏洞提升自己的权限。Python的imageop模块的imageop.c和rbgimgmodule.c文件中存在整数溢出漏洞，最终会导致堆溢出。如果用户受骗打开了恶意的图形文件的话，就可能触发这些溢出，导致执行任意指令。有漏洞的代码段如下：staticPyObject*imageop_tovideo(PyObject*self,PyObject*args){intmaxx,maxy,x,y,len;......................../****************intoverflowherepermittobypasslencheck********************/if(maxx*maxy*width!=len){PyErr_SetString(ImageopError,"Stringhasincorrectlength");return0;}rv=PyString_FromStringAndSize(NULL,len);if(rv==0)return0;ncp=(unsignedchar*)PyString_AsString(rv);if(width==1){memcpy(ncp,cp,maxx);/*Copyfirstline*/ncp+=maxx;/***********withanegativvalueit'spossibletobypassthecode***********/for(y=1;y

来源:US-CERT
名称:TA07-352A
链接:http://www.us-cert.gov/cas/techalerts/TA07-352A.html
来源:VUPEN
名称:ADV-2009-3316
链接:http://www.vupen.com/english/advisories/2009/3316
来源:www.vmware.com
链接:http://www.vmware.com/security/advisories/VMSA-2009-0016.html
来源:BID
名称:25696
链接:http://www.securityfocus.com/bid/25696
来源:BUGTRAQ
名称:20091120VMSA-2009-0016VMwarevCenterandESXupdatereleaseandvMApatchreleaseaddressmultiplesecurityissueinthirdpartycomponents
链接:http://www.securityfocus.com/archive/1/archive/1/507985/100/0/threaded
来源:REDHAT
名称:RHSA-2008:0629
链接:http://www.redhat.com/support/errata/RHSA-2008-0629.html
来源:DEBIAN
名称:DSA-1620
链接:http://www.debian.org/security/2008/dsa-1620
来源:support.apple.com
链接:http://support.apple.com/kb/HT3438
来源:SECUNIA
名称:37471
链接:http://secunia.com/advisories/37471
来源:SECUNIA
名称:33937
链接:http://secunia.com/advisories/33937
来源:SECUNIA
名称:31492
链接:http://secunia.com/advisories/31492
来源:SECUNIA
名称:31255
链接:http://secunia.com/advisories/31255
来源:FULLDISC
名称:20070916python<=2.5.