Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request, a different vulnerability than CVE-2012-4504.

The remote Solaris system is missing necessary patches to address security updates :

  - Stack-based buffer overflow in the url::get_pac function     in url.cpp in libproxy 0.4.x before 0.4.9 allows remote     servers to have an unspecified impact via a large     proxy.pac file. (CVE-2012-4504)

  - Heap-based buffer overflow in the px_pac_reload function     in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote     servers to have an unspecified impact via a crafted     Content-Length size in an HTTP response header for a     proxy.pac file request, a different vulnerability than     CVE-2012-4504. (CVE-2012-4505)

This update of libproxy fixed a buffer overflow flaw.

A buffer overflow flaw was found in the way libproxy handled the downloading of proxy auto-configuration (PAC) files. A malicious server hosting a PAC file or a man-in-the-middle attacker could use this flaw to cause an application using libproxy to crash or, possibly, execute arbitrary code, if the proxy settings obtained by libproxy (from the environment or the desktop environment settings) instructed the use of a PAC proxy configuration. (CVE-2012-4505)

From Red Hat Security Advisory 2012:1461 :

Updated libproxy packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

libproxy is a library that handles all the details of proxy configuration.

A buffer overflow flaw was found in the way libproxy handled the downloading of proxy auto-configuration (PAC) files. A malicious server hosting a PAC file or a man-in-the-middle attacker could use this flaw to cause an application using libproxy to crash or, possibly, execute arbitrary code, if the proxy settings obtained by libproxy (from the environment or the desktop environment settings) instructed the use of a PAC proxy configuration. (CVE-2012-4505)

This issue was discovered by the Red Hat Security Response Team.

Users of libproxy should upgrade to these updated packages, which contain a backported patch to correct this issue. All applications using libproxy must be restarted for this update to take effect.

This update for libproxy fixes a heap-based buffer overflow that could have allowed remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request. (CVE-2012-4505)

Additionally, it fixes parsing of the $no_proxy environment variable when it contains more than one URL separated by white-spaces.

A buffer overflow flaw was found in the way libproxy handled the downloading of proxy auto-configuration (PAC) files. A malicious server hosting a PAC file or a man-in-the-middle attacker could use this flaw to cause an application using libproxy to crash or, possibly, execute arbitrary code, if the proxy settings obtained by libproxy (from the environment or the desktop environment settings) instructed the use of a PAC proxy configuration. (CVE-2012-4505)

All applications using libproxy must be restarted for this update to take effect.

Updated libproxy packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

libproxy is a library that handles all the details of proxy configuration.

A buffer overflow flaw was found in the way libproxy handled the downloading of proxy auto-configuration (PAC) files. A malicious server hosting a PAC file or a man-in-the-middle attacker could use this flaw to cause an application using libproxy to crash or, possibly, execute arbitrary code, if the proxy settings obtained by libproxy (from the environment or the desktop environment settings) instructed the use of a PAC proxy configuration. (CVE-2012-4505)

This issue was discovered by the Red Hat Security Response Team.

Users of libproxy should upgrade to these updated packages, which contain a backported patch to correct this issue. All applications using libproxy must be restarted for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1461 advisory.

  - libproxy: PAC handling insufficient content length check leading to buffer overflow (CVE-2012-4505)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Tomas Mraz discovered that libproxy incorrectly handled certain PAC files. A remote attacker could use this issue to cause libproxy to crash, or to possibly execute arbitrary code. (CVE-2012-4504, CVE-2012-4505).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Red Hat Security Response Team discovered that libproxy, a library for automatic proxy configuration management, applied insufficient validation to the Content-Length header sent by a server providing a proxy.pac file. Such remote server could trigger an integer overflow and consequently overflow an in-memory buffer.

ID	Name	Product	Family	Severity
80675	Oracle Solaris Third-Party Patch Update : libproxy (multiple_buffer_errors_vulnerability_in1)	Nessus	Solaris Local Security Checks	critical
74787	openSUSE Security Update : libproxy / libproxy-plugins (openSUSE-SU-2012:1375-1)	Nessus	SuSE Local Security Checks	critical
69630	Amazon Linux AMI : libproxy (ALAS-2012-140)	Nessus	Amazon Linux Local Security Checks	critical
68657	Oracle Linux 6 : libproxy (ELSA-2012-1461)	Nessus	Oracle Linux Local Security Checks	critical
64191	SuSE 11.2 Security Update : libproxy (SAT Patch Number 7092)	Nessus	SuSE Local Security Checks	critical
62933	Scientific Linux Security Update : libproxy on SL6.x i386/x86_64 (20121114)	Nessus	Scientific Linux Local Security Checks	critical
62928	CentOS 6 : libproxy (CESA-2012:1461)	Nessus	CentOS Local Security Checks	critical
62922	RHEL 6 : libproxy (RHSA-2012:1461)	Nessus	Red Hat Local Security Checks	critical
62899	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS : libproxy vulnerabilities (USN-1629-1)	Nessus	Ubuntu Local Security Checks	critical
62804	Debian DSA-2571-1 : libproxy - buffer overflow	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2012-4505

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical