Mandriva je objavila nadogradnju za programski paket python koja ispravlja nekoliko propusta koji bi uspješnim iskorištavanjem mogli dovesti do neovlaštenog pristupa osjetljivim informacijama.
Paket:
python 2.x, python 3.x
Operacijski sustavi:
Mandriva Linux 2009.0, Mandriva Linux 2010.1, Mandriva Linux Corporate 4.0, Mandriva Linux Enterprise Server 5.0
Kritičnost:
8.5
Problem:
neodgovarajuće rukovanje datotekama, pogreška u programskoj komponenti
Iskorištavanje:
udaljeno
Posljedica:
neovlašteni pristup sustavu, otkrivanje osjetljivih informacija
Rješenje:
programska zakrpa proizvođača
CVE:
CVE-2011-1015, CVE-2011-1521
Izvorni ID preporuke:
MDVSA-2011:096
Izvor:
Mandriva
Problem:
Javlja se pogreška vezana uz "CGIHTTPServer.py" skriptu u modulu CGIHTTPServer. Također, u bibiliotekama urllib i urllib2 se javlja problem neraspoznavanja različitih odredišnih URL adresa prilikom automatskih preusmjeravanja.
Posljedica:
Uspješni napadači mogu iskoristiti propuste za čitanje programskog koda skripti putem HTTP GET zahtjeva kojima nedostaje "/" znak. Drugi propust je moguće iskoristiti za neovlašteni pristup lokalnim mrežnim dokumentima.
Rješenje:
Kako do posljedica propusta ne bi došlo svi se korisnici ranjivog paketa upućuju na korištenje dostupne programske nadogradnje.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2011:096
http://www.mandriva.com/security/
_______________________________________________________________________
Package : python
Date : May 22, 2011
Affected: 2009.0, 2010.1, Corporate 4.0, Enterprise Server 5.0
_______________________________________________________________________
Problem Description:
Multiple vulnerabilities have been identified and fixed in python:
The is_cgi method in CGIHTTPServer.py in the CGIHTTPServer module
in Python 2.5, 2.6, and 3.0 allows remote attackers to read script
source code via an HTTP GET request that lacks a / (slash) character
at the beginning of the URI (CVE-2011-1015).
A flaw was found in the Python urllib and urllib2 libraries where
they would not differentiate between different target URLs when
handling automatic redirects. This caused Python applications using
these modules to follow any new URL that they understood, including
the file:// URL type. This could allow a remote server to force a
local Python application to read a local file instead of the remote
one, possibly exposing local files that were not meant to be exposed
(CVE-2011-1521).
Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490
The updated packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1015
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1521
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2009.0:
71a60b6ca82c16cfa81779f586aa2c0a
2009.0/i586/libpython2.5-2.5.2-5.10mdv2009.0.i586.rpm
2138c57ad81a8beaf0c1eb999fd08818
2009.0/i586/libpython2.5-devel-2.5.2-5.10mdv2009.0.i586.rpm
6c9a3ffe4bc52ed61e77a77c374ad2c4
2009.0/i586/python-2.5.2-5.10mdv2009.0.i586.rpm
0d31faceacbae7dc06f844d1214e2d16
2009.0/i586/python-base-2.5.2-5.10mdv2009.0.i586.rpm
49b78565dcb28d01e5c691b0f2bcd3af
2009.0/i586/python-docs-2.5.2-5.10mdv2009.0.i586.rpm
1ffd2e9dd42735800a7f6ad7d941a5ac
2009.0/i586/tkinter-2.5.2-5.10mdv2009.0.i586.rpm
cdafb079c8e76379949c49c3cb1ef4b2
2009.0/i586/tkinter-apps-2.5.2-5.10mdv2009.0.i586.rpm
5cb94b684ff22b2eda7e04753bdce16d
2009.0/SRPMS/python-2.5.2-5.10mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
e04c68e9eb21516ce89484751ded4332
2009.0/x86_64/lib64python2.5-2.5.2-5.10mdv2009.0.x86_64.rpm
92622926645273db1a646a736ea2a432
2009.0/x86_64/lib64python2.5-devel-2.5.2-5.10mdv2009.0.x86_64.rpm
c427548e0873e70318b9c945a09bba83
2009.0/x86_64/python-2.5.2-5.10mdv2009.0.x86_64.rpm
03f147cad7afa130c07920fe93426bc3
2009.0/x86_64/python-base-2.5.2-5.10mdv2009.0.x86_64.rpm
70162d5fe5b7808212243660f9e54241
2009.0/x86_64/python-docs-2.5.2-5.10mdv2009.0.x86_64.rpm
a86197e50c1c75c0256f7e40cab56a34
2009.0/x86_64/tkinter-2.5.2-5.10mdv2009.0.x86_64.rpm
926914ec91cb07fc4e796dc9f9245f3f
2009.0/x86_64/tkinter-apps-2.5.2-5.10mdv2009.0.x86_64.rpm
5cb94b684ff22b2eda7e04753bdce16d
2009.0/SRPMS/python-2.5.2-5.10mdv2009.0.src.rpm
Mandriva Linux 2010.1:
53d5109e8564c4532d5dedef2ac043f4
2010.1/i586/libpython2.6-2.6.5-2.3mdv2010.2.i586.rpm
023b47ab6db33ddcd14b69a3b7d9b6f8
2010.1/i586/libpython2.6-devel-2.6.5-2.3mdv2010.2.i586.rpm
ca24b1ba72889504816ff01f8296dad7
2010.1/i586/python-2.6.5-2.3mdv2010.2.i586.rpm
9f951c32522a8d4a20dc6218d7f5b977
2010.1/i586/python-docs-2.6.5-2.3mdv2010.2.i586.rpm
17194376e65542d2a94c650ac3b4d895
2010.1/i586/tkinter-2.6.5-2.3mdv2010.2.i586.rpm
7cbc356feff956567b2f5ab6d64f3600
2010.1/i586/tkinter-apps-2.6.5-2.3mdv2010.2.i586.rpm
31ecbe18b9a10119e03ef380a913db1e
2010.1/SRPMS/python-2.6.5-2.3mdv2010.2.src.rpm
Mandriva Linux 2010.1/X86_64:
81b99d093052e70a8a53085917e4afb3
2010.1/x86_64/lib64python2.6-2.6.5-2.3mdv2010.2.x86_64.rpm
fcc80b83b1fdce270e712f2657fbb8ca
2010.1/x86_64/lib64python2.6-devel-2.6.5-2.3mdv2010.2.x86_64.rpm
f3c02fbd937c6100b4a65e334055e7fa
2010.1/x86_64/python-2.6.5-2.3mdv2010.2.x86_64.rpm
1043662e88b55abe675a263082ce82c2
2010.1/x86_64/python-docs-2.6.5-2.3mdv2010.2.x86_64.rpm
93ba6c063614368421de9e4b4bdbbb6a
2010.1/x86_64/tkinter-2.6.5-2.3mdv2010.2.x86_64.rpm
cf0decdce784a86d5307dd19b6914a8e
2010.1/x86_64/tkinter-apps-2.6.5-2.3mdv2010.2.x86_64.rpm
31ecbe18b9a10119e03ef380a913db1e
2010.1/SRPMS/python-2.6.5-2.3mdv2010.2.src.rpm
Corporate 4.0:
198c6a033fc80b0355e065a14f644696
corporate/4.0/i586/libpython2.4-2.4.5-0.8.20060mlcs4.i586.rpm
c0616f9351989ea9d7033d958a5eafd8
corporate/4.0/i586/libpython2.4-devel-2.4.5-0.8.20060mlcs4.i586.rpm
e1becc70b0a76ca8ae6ceb1697705171
corporate/4.0/i586/python-2.4.5-0.8.20060mlcs4.i586.rpm
1e43557301ab20d6ef1deaee5095987f
corporate/4.0/i586/python-base-2.4.5-0.8.20060mlcs4.i586.rpm
ad1797a8ded8c1ef1eaa4ff94f0a090e
corporate/4.0/i586/python-docs-2.4.5-0.8.20060mlcs4.i586.rpm
1e086c1a3d1074363f2d5e8d9c396e4e
corporate/4.0/i586/tkinter-2.4.5-0.8.20060mlcs4.i586.rpm
cc3e848102354412fe99da194af47f39
corporate/4.0/SRPMS/python-2.4.5-0.8.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
da20c277e2ff0776b7499287096702ac
corporate/4.0/x86_64/lib64python2.4-2.4.5-0.8.20060mlcs4.x86_64.rpm
d0075eb6df5b520c04eb936f10a73c32
corporate/4.0/x86_64/lib64python2.4-devel-2.4.5-0.8.20060mlcs4.x86_64.rpm
b491194cce5942ad249ba283c52954b0
corporate/4.0/x86_64/python-2.4.5-0.8.20060mlcs4.x86_64.rpm
13d75957e66ce76d338e9326cad6cdff
corporate/4.0/x86_64/python-base-2.4.5-0.8.20060mlcs4.x86_64.rpm
f7896e57d5b843f3f7ff7dd4b3eebe03
corporate/4.0/x86_64/python-docs-2.4.5-0.8.20060mlcs4.x86_64.rpm
70586950943cc3dafce38ac09a0ff83d
corporate/4.0/x86_64/tkinter-2.4.5-0.8.20060mlcs4.x86_64.rpm
cc3e848102354412fe99da194af47f39
corporate/4.0/SRPMS/python-2.4.5-0.8.20060mlcs4.src.rpm
Mandriva Enterprise Server 5:
d28940e4700e46457096fcc2a13307cc
mes5/i586/libpython2.5-2.5.2-5.10mdvmes5.2.i586.rpm
bcf1487a2fae5458d9ab0ac34a5a307a
mes5/i586/libpython2.5-devel-2.5.2-5.10mdvmes5.2.i586.rpm
38c26a661f8858439a1cc2df1bd41df5
mes5/i586/python-2.5.2-5.10mdvmes5.2.i586.rpm
9b13e52c7ef8e8d0795d7fdc6808b2b8
mes5/i586/python-base-2.5.2-5.10mdvmes5.2.i586.rpm
5002cd05dd26292cb2cee766a6555865
mes5/i586/python-docs-2.5.2-5.10mdvmes5.2.i586.rpm
36426ccd627743116fad029322e53dd3
mes5/i586/tkinter-2.5.2-5.10mdvmes5.2.i586.rpm
fa420530fd85947a87b3f45eeff156f3
mes5/i586/tkinter-apps-2.5.2-5.10mdvmes5.2.i586.rpm
95e5e9d7cf268894a9d520de0ce560d0
mes5/SRPMS/python-2.5.2-5.10mdvmes5.2.src.rpm
Mandriva Enterprise Server 5/X86_64:
23d67a8f9b6d8815dca9b8bd4664f40a
mes5/x86_64/lib64python2.5-2.5.2-5.10mdvmes5.2.x86_64.rpm
d64356213d58f79800d4948880c5eeb6
mes5/x86_64/lib64python2.5-devel-2.5.2-5.10mdvmes5.2.x86_64.rpm
75a6f96e22760d4fdcc2ae46a512b260
mes5/x86_64/python-2.5.2-5.10mdvmes5.2.x86_64.rpm
efcf39cf6b3bcc1d78fd35be60215b59
mes5/x86_64/python-base-2.5.2-5.10mdvmes5.2.x86_64.rpm
fba99d4b5b1ff39ab9521a543d7c6ec8
mes5/x86_64/python-docs-2.5.2-5.10mdvmes5.2.x86_64.rpm
68763e27ed0848ca8f9d2d30f31b02d9
mes5/x86_64/tkinter-2.5.2-5.10mdvmes5.2.x86_64.rpm
5ee0e3d48de97f70edd16ff8dc13615e
mes5/x86_64/tkinter-apps-2.5.2-5.10mdvmes5.2.x86_64.rpm
95e5e9d7cf268894a9d520de0ce560d0
mes5/SRPMS/python-2.5.2-5.10mdvmes5.2.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFN2PFImqjQ0CJFipgRAiU/AJ4r8U479TGDL2Y/y8pnigz1WmCxMgCgsARl
AYo6vcjj/qwevAUXSbsysc8=
=oy4t
-----END PGP SIGNATURE-----
Posljednje sigurnosne preporuke