CVE-2010-1450

Vulnerability

The rgbimg module in Python 2.5 contains multiple buffer overflows in its RLE decoder, specifically in the longimagedata and expandrow functions [3]. The module fails to validate the ZSIZE (number of channels) field in SGI image headers, which can be set to values up to 0xffff, while the code assumes ZSIZE ≤ 4, leading to a negative pointer adjustment and buffer underflow [3]. Additionally, an integer overflow can occur when computing buffer sizes from xsize * ysize * zsize [4]. These issues affect Python 2.5 and are present in Red Hat Enterprise Linux 3, 4, and 5 [3].

Exploitation

An attacker can exploit these vulnerabilities by providing a specially crafted SGI image file to an application that uses the rgbimg module. No authentication is required if the application processes user-supplied images. The attacker can set a large ZSIZE value or craft RLE data to trigger the buffer overflow [3][4]. The Python bug tracker provides test files that demonstrate the crashes [4].

Impact

Successful exploitation can lead to denial of service (Python VM crash) and potentially arbitrary code execution due to the buffer overflow [3]. The exact impact depends on the memory layout and the attacker's control over the overflow data.

Mitigation

Red Hat released security updates (RHSA-2011-0260 [1] and RHSA-2011-0027 [2]) to address these issues in Red Hat Enterprise Linux. Users should apply the appropriate patches. For other distributions, upgrading to a patched version of Python is recommended. No workaround is available other than avoiding the use of the rgbimg module with untrusted images.