Description
Stack-based buffer overflow in Python 2.4.2 and earlier, running on Linux 2.6.12.5 under gcc 4.0.3 with libc 2.3.5, allows local users to cause a "stack overflow," and possibly gain privileges, by running a script from a current working directory that has a long name, related to the realpath function. NOTE: this might not be a vulnerability. However, the fact that it appears in a programming language interpreter could mean that some applications are affected, although attack scenarios might be limited because the attacker might already need to cross privilege boundaries to cause an exploitable program to be placed in a directory with a long name; or, depending on the method that Python uses to determine the current working directory, setuid applications might be affected.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | rhn-solaris-bootstrap | 5.0.2-3 | RHSA-2008:0629, RHSA-2008:0264 |
| Red Hat Network Satellite 5 | rhn_solaris_bootstrap_5_0_2_3 +1 | 1-0 | RHSA-2008:0629, RHSA-2008:0264 |
| Red Hat Network Satellite 4 | rhn-solaris-bootstrap | 5.0.2-3 | RHSA-2008:0525 |
| Red Hat Network Satellite 4 | rhn_solaris_bootstrap_5_0_2_3 | 1-0 | RHSA-2008:0525 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-py | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Python 2.4.2 - 'realpath()' Local Stack Overflow EDB-1591 · local · Mar 18, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2008:0629 Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0525 Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0264 Red Hat Security Advisory: Red Hat Network Satellite Server Solaris client security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
References
- 31492 third-party-advisory
- RHSA-2008:0629 vendor-advisory
- 1591 exploit
- http://www.gotfault.net/research/exploit/gexp-python.py