Date: Tue, 28 Jan 2014 23:44:22 +0100 From: Gerhard Rieger <gerhard@...t-unreach.org> To: oss-security@...ts.openwall.com Subject: Socat security advisory 5 - PROXY-CONNECT address overflow Socat security advisory 5 - PROXY-CONNECT address overflow Overview socats PROXY-CONNECT address is vulnerable to a buffer overflow with data from command line Vulnerability Id: CVE-2014-0019 Serverity: Low Details Due to a missing check during assembly of the HTTP request line a long target server name (<hostname> in the documentation) in the PROXY-CONNECT address can cause a stack buffer overrun. Exploitation requires that the attacker is able to provide the target server name to the PROXY-CONNECT address in the command line. This can happen for example in scripts that receive data from untrusted sources. Testcase This overflow can not always be reliably reproduced. It may be helpful to build socat with gcc option -Wp,-D_FORTIFY_SOURCE=2 or to run socat under ElectricFence or another memory checker. In one terminal run a dummy server because socat first needs to establish a connection: socat tcp-l:8080,reuseaddr /dev/null In a second terminal run the check: socat - PROXY-CONNECT:localhost:$(perl -e "print 'A' x 384"):1,proxyport=8080 If this command terminates with Segmentation Violation, with a buffer overflow message or similar, your version of socat is vulnerable. However, a Connection refused message does not necessarily mean that your version is not vulnerable! Affected versions 126.96.36.199 - 188.8.131.52 2.0.0-b1 - 2.0.0-b6 Not affected or corrected versions 184.108.40.206 - 220.127.116.11 18.104.22.168 and later 2.0.0-b7 and later Workaround Truncate the target server name to a length of 256 characters before passing it to socats command line Download The updated sources can be downloaded from: http://www.dest-unreach.org/socat/download/socat-22.214.171.124.tar.gz http://www.dest-unreach.org/socat/download/socat-2.0.0-b7.tar.gz Patch to 126.96.36.199: http://www.dest-unreach.org/socat/download/socat-188.8.131.52.patch.gz Patch to 2.0.0-b6: http://www.dest-unreach.org/socat/download/socat-2.0.0-b7.patch.gz Credits Credits to Florian Weimer of the Red Hat Product Security Team Download attachment "signature.asc" of type "application/pgp-signature" (539 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ