Bugzilla Bug 192876

According to SecurityFocus:
  Python's imageop module is prone to multiple integer-overflow
  vulnerabilities. These issues are due to a failure of the module to
  properly bounds-check user-supplied input to ensure that integer
  operations do not overflow.
  Successfully exploiting these issues require the ability to control
  the arguments to imageop functions. The ability for remote attackers
  to do this depends on the nature of applications that utilize the
  vulnerable functions.
  Attackers would likely submit invalid or specially-crafted images
  to applications that perform imageop operations on the data.
  Successfully exploiting these issues may allow attacker-supplied
  machine code to execute in the context of affected applications,
  facilitating the remote compromise of computers.

The issue was discovered by Slythers Bro.
I could reproduce a crash on x86. This is not an issue on amd64, as imageop is
not installed there.

Setting whiteboard and pulling in maintainers for advice.
As far as I can see, all pythons in the tree are vulnerable for this, at least
on 32bit installs.

CVE assigned CVE-2007-4965 to this issue. The description there only confirms
an attacker could "possibly obtain sensitive information" and "unspecified
other vectors", but no explicit code execution.

python, did you hear anything about this in upstream channels yet?

Upstream has a bug about this[1] and the last patch attached fixes the issue
but the patch is not perfect, see guido's comment[2].

[1]: http://bugs.python.org/issue1179
[2]: http://bugs.python.org/msg56052

Hawking is this one ready for ebuild?

As Robert mentioned, all python versions in the tree are affected by this.
I've committed three revbumps today, fixing the bug for all python versions
that we support.
python-2.3.6-r3, python-2.4.4-r6 and python-2.5.1-r3 are fixed versions.
To check whether the bug is fixed, the file poc.py attached to the bug I've
mentioned in my previous comment can be used. The expected output is:
"""
4545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545454545
Traceback (most recent call last):
  File "poc.py", line 12, in ?
      dtc = imageop.tovideo(sexshit,1,4461,-2147002257)
      imageop.error: String has incorrect length
"""

P.S: the variable names in the mentioned file are kinda weird.. well.. :-)

Thx Hawking

Arhces please test and mark stable. Target keywords are:

python-2.3.6-r3.ebuild:KEYWORDS="alpha amd64 arm hppa ia64 m68k mips ppc ppc64
s390 sh sparc x86"
python-2.4.4-r6.ebuild:KEYWORDS="alpha amd64 arm hppa ia64 m68k mips ppc ppc64
s390 sh sparc ~sparc-fbsd x86 ~x86-fbsd"

x86 stable

On amd64 Everything is working.Python works flawlessly still(emerge, and
various other things)

Portage 2.1.3.9 (default-linux/amd64/2007.0/desktop, gcc-4.1.2, glibc-2.6.1-r0,
2.6.22-gentoo-r8 x86_64)
=================================================================
System uname: 2.6.22-gentoo-r8 x86_64 AMD Athlon(tm) 64 Processor 3400+
Timestamp of tree: Thu, 25 Oct 2007 01:47:01 +0000
ccache version 2.4 [enabled]
app-shells/bash:     3.2_p17
dev-lang/python:     2.4.4-r6
dev-python/pycrypto: 2.0.1-r6
dev-util/ccache:     2.4-r7
sys-apps/baselayout: 1.12.9-r2
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.18-r1
sys-devel/gcc-config: 1.3.16
sys-devel/libtool:   1.5.24
virtual/os-headers:  2.6.22-r2
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=athlon64 -O2 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/terminfo
/etc/udev/rules.d"
CXXFLAGS="-march=athlon64 -O2 -pipe"
DISTDIR="/distfiles"
FEATURES="ccache collision-protect distlocks metadata-transfer multilib-strict
parallel-fetch sandbox sfperms strict test unmerge-orphans userfetch"
GENTOO_MIRRORS="http://distfiles.gentoo.org
http://distro.ibiblio.org/pub/linux/distributions/gentoo"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude=/distfiles --exclude=/local --exclude=/packages
--filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/overlay"
SYNC="rsync://kv80/gentoo-portage"
USE="X acl acpi aim alsa amd64 arts berkdb bitmap-fonts branding cairo cli
cracklib crypt cups dbus dri dvd dvdread emboss encode esd evo fam firefox
fortran gdbm gif gpm gstreamer hal iconv imap ipv6 isdnlog jpeg kde kerberos
mad midi mikmod mmx mp3 mpeg mqsli mudflap mysql ncurses nls nptl nptlonly
nvidia ogg opengl openmp oss pam pcre pdf perl png pppd python qt3 qt3support
quicktime readline reflection sdl session sockets spell spl sqlite3 sse sse2
ssl svg tcpd test tiff truetype truetype-fonts type1-fonts unicode vim vorbis
xcomposite xine xml xorg xv zlib" ALSA_CARDS="ali5451 als4000 atiixp
atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801
hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem
ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug
file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate
route share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev"
KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001
mtxorb ncurses text" USERLAND="GNU" VIDEO_CARDS="nvidia"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS,
LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

ppc64 stable

amd64 done.

this bug is not done

alpha/ia64/sparc stable

Stable for HPPA.

ppc stable, ready for glsa

(In reply to comment #14)
> ready for glsa

Thanks, filed.

GLSA 200711-07