oss-security - Socat security advisory 8 - Stack overflow in parser

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <56AF7B26.9010700@dest-unreach.org>
Date: Mon, 1 Feb 2016 16:35:02 +0100
From: Gerhard Rieger <gerhard@...t-unreach.org>
To: oss-security@...ts.openwall.com
Subject: Socat security advisory 8 - Stack overflow in parser

Socat security advisory 8 - Stack overflow in parser

Overview
  A stack overflow vulnerability was found that can be triggered when
  command line arguments (complete address specifications, host names,
  file names) are longer than 512 bytes.
  Successful exploitation might allow an attacker to execute arbitrary code
  with the privileges of the socat process.
  This vulnerability can only be exploited when an attacker is able to
  inject data into socat's command line.
  A vulnerable scenario would be a CGI script that reads data from
  clients and uses (parts of) this data as hostname for a Socat
  invocation.

Vulnerability Ids
    Socat security issue 8

Severity: Low

Affected versions
  1.5.0.0 - 1.7.3.0
  2.0.0-b1 - 2.0.0-b8

Not affected or corrected versions
  1.0.0.0 - 1.4.3.1
  1.7.3.1 and later
  2.0.0-b9 and later

Workaround
  Do not pass unfiltered data from untrusted sources to socat's command line

Download
  The updated sources can be downloaded from:

    http://www.dest-unreach.org/socat/download/socat-1.7.3.1.tar.gz
    http://www.dest-unreach.org/socat/download/socat-2.0.0-b9.tar gz

Acknowledgement
    Takume Akiyma found and reported this issue.

Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.