CVE-2010-3493
Denial of Service in smtpd.py
- CVSS 4.3
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- Race Conditions
- Remote
Multiple race conditions in smtpd.py in the smtpd module in Python 2.6, 2.7, 3.1, and 3.2 alpha allow remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, or the getpeername function having an ENOTCONN error, a related issue to CVE-2010-3492.
- CWE
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- CVSS base score
- 4.3
- Published
- 2010-10-19
- OWASP
- A08 Software and Data Integrity Failures
- Orthogonal defect classification
- Timing/Serialization
- Code defect classification
- Timing Issues
- Category
- Race Conditions
- Subcategory
- Race Condition in File Operations
- Accessibility scope
- Remote
- Impact
- Denial of Service (DoS)
- Fixed by upgrading
- Yes
Solution
Upgrade to Python 2.7.1, 3.1.3, or later.
Vulnerable code sample
import CGIHTTPServer
server = CGIHTTPServer.CGIHTTPRequestHandler
server.cgi_directories = ["/cgi-bin"]
httpd = CGIHTTPServer.BaseHTTPServer.HTTPServer(("", 8000), server)
httpd.serve_forever()Patched code sample
import CGIHTTPServer
import socket
import sys
class CGIRequestHandler(CGIHTTPServer.CGIHTTPRequestHandler):
def handle(self):
try:
self.raw_requestline = self.rfile.readline(65537)
if len(self.raw_requestline) > 65536:
self.requestline = ''
self.request_version = ''
self.command = ''
self.send_error(414)
return
if not self.parse_request():
return
self.run_cgi()
except socket.error as e:
if e.args[0] in (socket.ECONNABORTED, socket.EAGAIN, socket.EWOULDBLOCK):
sys.stderr.write("Connection closed by peer: %s\n" % e)
elif e.args[0] == socket.ENOTCONN:
sys.stderr.write("Connection not established: %s\n" % e)
else:
sys.stderr.write("Socket error: %s\n" % e)
except Exception as e:
sys.stderr.write("Unknown error: %s\n" % e)
server = CGIRequestHandler
server.cgi_directories = ["/cgi-bin"]
httpd = CGIHTTPServer.BaseHTTPServer.HTTPServer(("", 8000), server)
httpd.serve_forever()Cite this entry
@misc{vaitp:cve20103493,
title = {{Denial of Service in smtpd.py}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2010},
note = {VAITP Python Vulnerability Dataset, entry CVE-2010-3493},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2010-3493/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::