CVE-2016-5636

Integer Overflow in zipimport.c in CPython

• CVSS 9.8
• CWE-190: Integer Overflow or Wraparound
• Numeric Errors
• Remote

Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.

CVE

CVE-2016-5636

CWE

CWE-190: Integer Overflow or Wraparound

CVSS base score

9.8

Published

2016-09-02

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Numeric Errors

Subcategory

Integer Overflows

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Python to version 2.7.12, 3.4.5, or 3.5.2 or later.

import zipfile

class ZipFile:
    def __init__(self, file):
        self.zip_file = zipfile.ZipFile(file)

    def get_data(self, name):
        info = self.zip_file.getinfo(name)
        return self.zip_file.read(name) 
    
if __name__ == "__main__":
    zip = ZipFile('example.zip')
    data = zip.get_data('somefile.txt')
    print(data)

import zipfile

class ZipFile:
    def __init__(self, file):
        self.zip_file = zipfile.ZipFile(file)

    def get_data(self, name):
        info = self.zip_file.getinfo(name)
        if info.file_size < 0:
            raise ValueError("Invalid file size detected, potential integer overflow.")
        return self.zip_file.read(name)

if __name__ == "__main__":
    try:
        zip = ZipFile('example.zip')
        data = zip.get_data('somefile.txt')
        print(data)
    except ValueError as e:
        print("Error:", e)

@misc{vaitp:cve20165636,
  title        = {{Integer Overflow in zipimport.c in CPython}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2016},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2016-5636},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2016-5636/}}
}