7.5
CVSSv2

CVE-2014-1912

Published: 01/03/2014 Updated: 25/10/2019
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
VMScore: 755
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 prior to 2.7.7, 3.x prior to 3.3.4, and 3.4.x prior to 3.4rc1 allows remote malicious users to execute arbitrary code via a crafted string.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

python python 2.7.6

python python 2.7.1150

python python 2.7.2

python python 2.7.2150

python python 2.6.4

python python 2.6.5

python python 2.7.5

python python 2.7.4

python python 2.7.3

python python 2.6.6

python python 2.6.6150

python python 2.5.3

python python 2.5.4

python python 2.7.1

python python 2.6.2150

python python 2.6.3

python python 2.5.1

python python 2.5.150

python python 2.5.2

python python 2.6.1

python python 2.6.2

python python 2.6.7

python python 2.6.8

python python 2.5.6

apple mac os x

python python 3.0.1

python python 3.1

python python 3.2

python python 3.2.5

python python 3.3

python python 3.3.3

python python 3.1.2150

python python 3.1.3

python python 3.2.2

python python 3.2.2150

python python 3.3.2

python python 3.4

python python 3.0

python python 3.1.4

python python 3.1.5

python python 3.2.3

python python 3.2.4

python python 3.1.1

python python 3.1.2

python python 3.2.0

python python 3.2.1

python python 3.3.0

python python 3.3.1

Vendor Advisories

Python could be made to crash or run programs if it received specially crafted network traffic ...
Multiple security issues were discovered in Python: CVE-2013-4238 Ryan Sleevi discovered that NULL characters in the subject alternate names of SSL cerficates were parsed incorrectly CVE-2014-1912 Ryan Smith-Roberts discovered a buffer overflow in the socketrecvfrom_into() function For the stable distribution (wheezy), these pr ...
Buffer overflow in the socketrecvfrom_into function in Modules/socketmodulec in Python 25 before 277, 3x before 334, and 34x before 34rc1 allows remote attackers to execute arbitrary code via a crafted string ...
Buffer overflow in the socketrecvfrom_into function in Modules/socketmodulec in Python 25 before 277, 3x before 334, and 34x before 34rc1 allows remote attackers to execute arbitrary code via a crafted string ...
It was discovered that the socketrecvfrom_into() function failed to check the size of the supplied buffer This could lead to a buffer overflow when the function was called with an insufficiently sized buffer ...

Exploits

#!/usr/bin/env python ''' # Exploit Title: python socketrecvfrom_into() remote buffer overflow # Date: 21/02/2014 # Exploit Author: @sha0coder # Vendor Homepage: pythonorg # Version: python27 and python3 # Tested on: linux 32bit + python27 # CVE : CVE-2014-1912 socketrecvfrom_into() remote buffer overflow Proof of concept by @sha0coder TO ...