CVE-2010-3492

The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function, and does not have accompanying documentation describing how daemon applications should handle unsuccessful calls to the accept function, which makes it easier for remote attackers to conduct denial of service attacks that terminate these applications via network connections.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://bugs.python.org/issue6706	Patch Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2010:215	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2010:216	Third Party Advisory
http://www.openwall.com/lists/oss-security/2010/09/09/6	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2010/09/11/2	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2010/09/22/3	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2010/09/24/3	Mailing List Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12111	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:python:python::::::::
	cpe:2.3:a:python:python::::::::

History

No history.

Information

Published : 2010-10-19 20:00

Updated : 2019-10-29 00:56

NVD link : CVE-2010-3492

Mitre link : CVE-2010-3492

CVE.ORG link : CVE-2010-3492

JSON object : View

Products Affected

python

python

CWE

NVD-CWE-Other

{"id": "CVE-2010-3492", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-10-19T20:00:04.237", "references": [{"url": "http://bugs.python.org/issue6706", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:215", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:216", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2010/09/09/6", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2010/09/11/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2010/09/22/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2010/09/24/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12111", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function, and does not have accompanying documentation describing how daemon applications should handle unsuccessful calls to the accept function, which makes it easier for remote attackers to conduct denial of service attacks that terminate these applications via network connections."}, {"lang": "es", "value": "El m\u00f3dulo asyncore en Python anterior a v3.2 no controla correctamente llamadas fallidas a la funci\u00f3n accept, y no tiene la documentaci\u00f3n adjunta que describa c\u00f3mo las aplicaciones demonio atienden las llamadas sin \u00e9xito a la funci\u00f3n accept, lo cual facilita a atacantes remotos realizar ataques de denegaci\u00f3n de servicio que terminan estas aplicaciones a trav\u00e9s de conexiones de red."}], "lastModified": "2019-10-29T00:56:18.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C7AE3F2-A21B-4F96-A7F5-6B105A8CE540", "versionEndIncluding": "2.7"}, {"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF69B7D8-20B0-44E3-9AE8-BD29691EE13E", "versionEndExcluding": "3.1.2", "versionStartIncluding": "3.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}