Date: Tue, 28 Jan 2014 23:44:22 +0100
From: Gerhard Rieger <gerhard@...t-unreach.org>
Subject: Socat security advisory 5 - PROXY-CONNECT address overflow
Socat security advisory 5 - PROXY-CONNECT address overflow
socats PROXY-CONNECT address is vulnerable to a buffer overflow with
data from command line
Vulnerability Id: CVE-2014-0019
Due to a missing check during assembly of the HTTP request line a
long target server name (<hostname> in the documentation) in
the PROXY-CONNECT address can cause a stack buffer overrun.
Exploitation requires that the attacker is able to provide the
target server name to the PROXY-CONNECT address in the command
line. This can happen for example in scripts that receive data
from untrusted sources.
This overflow can not always be reliably reproduced. It may be helpful
to build socat with gcc option -Wp,-D_FORTIFY_SOURCE=2 or to run socat
under ElectricFence or another memory checker.
In one terminal run a dummy server because socat first needs to
establish a connection:
socat tcp-l:8080,reuseaddr /dev/null
In a second terminal run the check:
socat - PROXY-CONNECT:localhost:$(perl -e "print 'A' x
If this command terminates with Segmentation Violation, with a
buffer overflow message or similar, your version of socat is
However, a Connection refused message does not necessarily mean that your
version is not vulnerable!
18.104.22.168 - 22.214.171.124
2.0.0-b1 - 2.0.0-b6
Not affected or corrected versions
126.96.36.199 - 188.8.131.52
184.108.40.206 and later
2.0.0-b7 and later
Truncate the target server name to a length of 256 characters before
passing it to socats command line
The updated sources can be downloaded from:
Patch to 220.127.116.11:
Patch to 2.0.0-b6:
Credits to Florian Weimer of the Red Hat Product Security Team
Download attachment "signature.asc" of type "application/pgp-signature" (539 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.