Date: Mon, 1 Feb 2016 16:35:02 +0100 From: Gerhard Rieger <gerhard@...t-unreach.org> To: oss-security@...ts.openwall.com Subject: Socat security advisory 8 - Stack overflow in parser Socat security advisory 8 - Stack overflow in parser Overview A stack overflow vulnerability was found that can be triggered when command line arguments (complete address specifications, host names, file names) are longer than 512 bytes. Successful exploitation might allow an attacker to execute arbitrary code with the privileges of the socat process. This vulnerability can only be exploited when an attacker is able to inject data into socat's command line. A vulnerable scenario would be a CGI script that reads data from clients and uses (parts of) this data as hostname for a Socat invocation. Vulnerability Ids Socat security issue 8 Severity: Low Affected versions 126.96.36.199 - 188.8.131.52 2.0.0-b1 - 2.0.0-b8 Not affected or corrected versions 184.108.40.206 - 220.127.116.11 18.104.22.168 and later 2.0.0-b9 and later Workaround Do not pass unfiltered data from untrusted sources to socat's command line Download The updated sources can be downloaded from: http://www.dest-unreach.org/socat/download/socat-22.214.171.124.tar.gz http://www.dest-unreach.org/socat/download/socat-2.0.0-b9.tar gz Acknowledgement Takume Akiyma found and reported this issue. Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ