Bug 246006 – dev-lang/python-1.5.2<=2.5.1 imageop.c multiple integer overflows (CVE-2008-4864)

• Status: RESOLVED INVALID
• Product: Gentoo Security

[Description Stefan Behte (RETIRED) 2008-11-07 21:22:37 UTC]

CVE-2008-4864 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4864):
  Multiple integer overflows in imageop.c in the imageop module in
  Python 1.5.2 through 2.5.1 allow context-dependent attackers to break
  out of the Python VM and execute arbitrary code via large integer
  values in certain arguments to the crop function, leading to a buffer
  overflow, a different vulnerability than CVE-2007-4965 and
  CVE-2008-1679.

[Comment 1 Stefan Behte (RETIRED) 2008-11-07 21:28:33 UTC]

Also see:
http://svn.python.org/view/python/trunk/Modules/imageop.c?rev=66689;view=diff;r1=66689;r2=66688;p1=python/trunk/Modules/imageop.c;p2=/python/trunk/Modules/imageop.c

This might be used in a webapplication and lead to remote compromise, but it should allow local privilege escalation, so giving it a severity of A1.

[Comment 2 Stefan Behte (RETIRED) 2008-11-07 21:33:52 UTC]

Python: please confirm that we've already disabled imageop in all our in-tree versions, see https://bugs.gentoo.org/show_bug.cgi?id=216673

[Comment 3 Stefan Behte (RETIRED) 2008-11-15 22:12:57 UTC]

python: *ping*

[Comment 4 Pierre-Yves Rofes (RETIRED) 2009-03-25 22:53:59 UTC]

Looks like one should be closed...

(In reply to comment #2)
> Python: please confirm that we've already disabled imageop in all our in-tree
> versions, see https://bugs.gentoo.org/show_bug.cgi?id=216673
> 
*ping*

[Comment 5 Arfrever Frehtes Taifersar Arahesis (RETIRED) 2009-05-16 20:20:46 UTC]

2.5.2-r7 and 2.5.4-r2 are stable on all architectures.

[Comment 6 Robert Buchholz (RETIRED) 2009-05-25 19:32:02 UTC]

/var/tmp/portage/dev-lang/python-2.4.6/work/2.4.6 $ cat 19_all_no-imageop.patch
--- setup.py    2008-05-21 10:26:35.000000000 +0300
+++ setup.py    2008-05-21 10:27:11.000000000 +0300
@@ -434,7 +434,8 @@
         # Disabled on 64-bit platforms
         if sys.maxint != 9223372036854775807L:
             # Operations on images
-            exts.append( Extension('imageop', ['imageop.c']) )
+            # Disable on 32 bit as well due to #216673
+            # exts.append( Extension('imageop', ['imageop.c']) )
             # Read SGI RGB image files (but coded portably)
             exts.append( Extension('rgbimg', ['rgbimgmodule.c']) )