Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation.

From Red Hat Security Advisory 2009:0344 :

Updated libsoup and evolution28-libsoup packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

libsoup is an HTTP client/library implementation for GNOME written in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.

An integer overflow flaw which caused a heap-based buffer overflow was discovered in libsoup's Base64 encoding routine. An attacker could use this flaw to crash, or, possibly, execute arbitrary code. This arbitrary code would execute with the privileges of the application using libsoup's Base64 routine to encode large, untrusted inputs.
(CVE-2009-0585)

All users of libsoup and evolution28-libsoup should upgrade to these updated packages, which contain a backported patch to resolve this issue. All running applications using the affected library function (such as Evolution configured to connect to the GroupWise back-end) must be restarted for the update to take effect.

An integer overflow flaw which caused a heap-based buffer overflow was discovered in libsoup's Base64 encoding routine. An attacker could use this flaw to crash, or, possibly, execute arbitrary code. This arbitrary code would execute with the privileges of the application using libsoup's Base64 routine to encode large, untrusted inputs.
(CVE-2009-0585)

All running applications using the affected library function (such as Evolution configured to connect to the GroupWise back-end) must be restarted for the update to take effect.

Large strings could lead to a heap overflow in the base64 encoding and decoding functions. Attackers could potentially exploit that to execute arbitrary code. (CVE-2009-0585)

Updated libsoup and evolution28-libsoup packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

libsoup is an HTTP client/library implementation for GNOME written in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.

An integer overflow flaw which caused a heap-based buffer overflow was discovered in libsoup's Base64 encoding routine. An attacker could use this flaw to crash, or, possibly, execute arbitrary code. This arbitrary code would execute with the privileges of the application using libsoup's Base64 routine to encode large, untrusted inputs.
(CVE-2009-0585)

All users of libsoup and evolution28-libsoup should upgrade to these updated packages, which contain a backported patch to resolve this issue. All running applications using the affected library function (such as Evolution configured to connect to the GroupWise back-end) must be restarted for the update to take effect.

It was discovered that the Base64 encoding functions in libsoup did not properly handle large strings. If a user were tricked into connecting to a malicious server, an attacker could possibly execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An integer overflow in libsoup Base64 encoding and decoding functions enables attackers either to cause denial of service and to execute arbitrary code (CVE-2009-0585).

This update provides the fix for that security issue.

It was discovered that libsoup, an HTTP library implementation in C, handles large strings insecurely via its Base64 encoding functions.
This could possibly lead to the execution of arbitrary code.

ID	Name	Product	Family	Severity
67822	Oracle Linux 4 / 5 : libsoup (ELSA-2009-0344)	Nessus	Oracle Linux Local Security Checks	high
60547	Scientific Linux Security Update : libsoup on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
41551	SuSE 10 Security Update : libsoup (ZYPP Patch Number 6223)	Nessus	SuSE Local Security Checks	high
41297	SuSE9 Security Update : libsoup (YOU Patch Number 12411)	Nessus	SuSE Local Security Checks	high
38892	CentOS 4 : libsoup (CESA-2009:0344)	Nessus	CentOS Local Security Checks	high
38092	Ubuntu 6.06 LTS / 7.10 : libsoup vulnerability (USN-737-1)	Nessus	Ubuntu Local Security Checks	high
37334	Mandriva Linux Security Advisory : libsoup (MDVSA-2009:081)	Nessus	Mandriva Local Security Checks	high
35980	Debian DSA-1748-1 : libsoup - integer overflow	Nessus	Debian Local Security Checks	high
35944	RHEL 4 / 5 : libsoup (RHSA-2009:0344)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2009-0585

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high