oss-security - Socat security advisory 5 - PROXY-CONNECT address overflow

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <52E832C6.7020204@dest-unreach.org>
Date: Tue, 28 Jan 2014 23:44:22 +0100
From: Gerhard Rieger <gerhard@...t-unreach.org>
To: oss-security@...ts.openwall.com
Subject: Socat security advisory 5 - PROXY-CONNECT address overflow

Socat security advisory 5 - PROXY-CONNECT address overflow

Overview
  socats PROXY-CONNECT address is vulnerable to a buffer overflow with
  data from command line

Vulnerability Id: CVE-2014-0019

Serverity: Low

Details
  Due to a missing check during assembly of the HTTP request line a
  long target server name (<hostname> in the documentation) in
  the PROXY-CONNECT address can cause a stack buffer overrun.
  Exploitation requires that the attacker is able to provide the
  target server name to the PROXY-CONNECT address in the command
  line. This can happen for example in scripts that receive data
  from untrusted sources.

Testcase
  This overflow can not always be reliably reproduced. It may be helpful
  to build socat with gcc option -Wp,-D_FORTIFY_SOURCE=2 or to run socat
  under ElectricFence or another memory checker.

  In one terminal run a dummy server because socat first needs to
  establish a connection:

    socat tcp-l:8080,reuseaddr /dev/null

  In a second terminal run the check:

    socat - PROXY-CONNECT:localhost:$(perl -e "print 'A' x
384"):1,proxyport=8080

  If this command terminates with Segmentation Violation, with a
  buffer overflow message or similar, your version of socat is
  vulnerable.

  However, a Connection refused message does not necessarily mean that your
  version is not vulnerable!

Affected versions
  1.3.0.0 - 1.7.2.2
  2.0.0-b1 - 2.0.0-b6

Not affected or corrected versions
  1.0.0.0 - 1.2.0.0
  1.7.2.3 and later
  2.0.0-b7 and later

Workaround
  Truncate the target server name to a length of 256 characters before
  passing it to socats command line

Download
  The updated sources can be downloaded from:

    http://www.dest-unreach.org/socat/download/socat-1.7.2.3.tar.gz
    http://www.dest-unreach.org/socat/download/socat-2.0.0-b7.tar.gz

  Patch to 1.7.2.2:
    http://www.dest-unreach.org/socat/download/socat-1.7.2.3.patch.gz

  Patch to 2.0.0-b6:
    http://www.dest-unreach.org/socat/download/socat-2.0.0-b7.patch.gz

Credits
   Credits to Florian Weimer of the Red Hat Product Security Team

Download attachment "signature.asc" of type "application/pgp-signature" (539 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.