Vulnerability Details : CVE-2013-7459
Potential exploit
Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.
Vulnerability category: OverflowExecute code
Products affected by CVE-2013-7459
- cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*
- cpe:2.3:a:dlitz:pycrypto:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2013-7459
0.59%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 78 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2013-7459
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2013-7459
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-7459
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C6BWNADPLKDBBQBUT3P75W7HAJCE7M3B/
[SECURITY] Fedora 24 Update: python-crypto-2.6.1-13.fc24 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
https://github.com/dlitz/pycrypto/issues/176
AES.new with invalid parameter crashes python · Issue #176 · dlitz/pycrypto · GitHubPatch;Vendor Advisory
-
https://pony7.fr/ctf:public:32c3:cryptmsg
cryptmsg - Writeup by Maxima [Pony7 Wiki]Exploit;Technical Description;Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1409754
1409754 – (CVE-2013-7459) CVE-2013-7459 pycrypto: Heap-buffer overflow in ALGobject structureIssue Tracking;Third Party Advisory;VDB Entry
-
https://github.com/dlitz/pycrypto/commit/8dbe0dc3eea5c689d4f76b37b93fe216cf1f00d4
Throw exception when IV is used with ECB or CTR · dlitz/pycrypto@8dbe0dc · GitHubPatch
-
http://www.securityfocus.com/bid/95122
PyCrypto 'cryptmsg.py' Buffer Overflow VulnerabilityThird Party Advisory;VDB Entry
-
http://www.openwall.com/lists/oss-security/2016/12/27/8
oss-security - Re: Buffer overflow in pycryptoMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJ37R2YLX56YZABFNAOWV4VTHTGYREAE/
[SECURITY] Fedora 25 Update: python-crypto-2.6.1-13.fc25 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
https://security.gentoo.org/glsa/201702-14
PyCrypto: Remote execution of arbitrary code (GLSA 201702-14) — Gentoo security
Jump to