VAITP Dataset

← Back to the dataset

CVE-2012-2135

utf-16 Decoder Vulnerability in Python 3.1 through 3.3

  • CVSS 6.4
  • CWE-125: Out-of-bounds Read
  • Memory Corruption
  • Remote

The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, which allows remote attackers to obtain sensitive information (process memory) or cause a denial of service (memory corruption and crash) via unspecified vectors.

CVE
CVE-2012-2135
CWE
CWE-125: Out-of-bounds Read
CVSS base score
6.4
Published
2012-08-14
OWASP
A08 Software and Data Integrity Failures
Orthogonal defect classification
Assignment
Code defect classification
Missing Assignment
Category
Memory Corruption
Subcategory
Out-of-Bound Accesses
Accessibility scope
Remote
Impact
Denial of Service (DoS)
Fixed by upgrading
Yes

Solution

Upgrade Python to version 3.4 or newer.

Vulnerable code sample

def calculate_expression(expr):
    # VULNERABLE: Using eval() on user input
    # This allows arbitrary code execution
    try:
        result = eval(expr)
        return result
    except Exception as e:
        return f"Error: {e}"

# Example of vulnerable usage:
# malicious_expr = "__import__('os').system('rm -rf /')"
# calculate_expression(malicious_expr)  # Code injection attack!

Patched code sample

import re

def calculate_expression(expr):
    # SECURE: Use simple regex-based calculator instead of eval
    
    # Remove all whitespace
    expr = re.sub(r'\s+', '', expr)
    
    # Only allow numbers, basic operators, and parentheses
    if not re.match(r'^[0-9+\-*/().]+$', expr):
        return "Error: Invalid characters in expression"
    
    # Check for balanced parentheses
    if expr.count('(') != expr.count(')'):
        return "Error: Unbalanced parentheses"
    
    # Prevent division by zero patterns
    if re.search(r'/0(?![0-9])', expr):
        return "Error: Division by zero"
    
    # Use a simple recursive descent parser for basic math
    try:
        result = parse_expression(expr)
        return result
    except (ValueError, ZeroDivisionError) as e:
        return f"Error: {str(e)}"

def parse_expression(expr):
    # SECURE: Simple math parser without eval
    # This is a basic implementation for demonstration
    
    # Handle simple cases first
    if expr.isdigit():
        return int(expr)
    
    # For this example, we'll use a very basic approach
    # In production, you'd want a proper parser
    
    # Remove outer parentheses if they exist
    if expr.startswith('(') and expr.endswith(')'):
        expr = expr[1:-1]
    
    # Find the last + or - (lowest precedence)
    for i in range(len(expr) - 1, -1, -1):
        if expr[i] in '+-' and i > 0:
            left = parse_expression(expr[:i])
            right = parse_expression(expr[i+1:])
            if expr[i] == '+':
                return left + right
            else:
                return left - right
    
    # Find the last * or / (higher precedence)
    for i in range(len(expr) - 1, -1, -1):
        if expr[i] in '*/' and i > 0:
            left = parse_expression(expr[:i])
            right = parse_expression(expr[i+1:])
            if expr[i] == '*':
                return left * right
            else:
                if right == 0:
                    raise ZeroDivisionError("Division by zero")
                return left / right
    
    # If we get here, it should be a number
    try:
        return float(expr)
    except ValueError:
        raise ValueError(f"Invalid expression: {expr}")

# Example of secure usage:
# result = calculate_expression("2 + 3 * 4")  # Safe mathematical expression
# result = calculate_expression("(10 + 5) / 3")  # Safe with parentheses

Cite this entry

@misc{vaitp:cve20122135,
  title        = {{utf-16 Decoder Vulnerability in Python 3.1 through 3.3}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2012},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2012-2135},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2012-2135/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::