stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow.

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2013-374:01 advisory.

    Stunnel is a socket wrapper which can provide SSL (Secure Sockets Layer) support to ordinary applications.
    For example, it can be used in conjunction with imapd to create an SSL secure IMAP server.
    Security issues fixed with this release:
     CVE-2013-1762     stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not     correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a     crafted request that triggers a buffer overflow.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201402-08 (stunnel: Arbitrary code execution)

    A buffer overflow vulnerability has been discovered in stunnel. Please       review the CVE identifier referenced below for details.
  Impact :

    A remote attacker could entice a user to connect to a malicious proxy       server, resulting in the execution of arbitrary code within the       configured chroot directory, with the privileges of the user running       stunnel. Please review the references below for details.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2013-0714 advisory.

    [4.29-3]     Resolves: CVE-2013-1762

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Stunnel, a program designed to work as an universal SSL tunnel for network daemons, is prone to a buffer overflow vulnerability when using the Microsoft NT LAN Manager (NTLM) authentication ('protocolAuthentication = NTLM') together with the 'connect'protocol method ('protocol = connect'). With these prerequisites and using stunnel4 in SSL client mode ('client = yes') on a 64 bit host, an attacker could possibly execute arbitrary code with the privileges of the stunnel process, if the attacker can either control the specified proxy server or perform man-in-the-middle attacks on the tcp session between stunnel and the proxy sever.

Note that for the testing distribution (wheezy) and the unstable distribution (sid), stunnel4 is compiled with stack smashing protection enabled, which should help protect against arbitrary code execution.

This update for stunnel fixes a buffer overflow vulnerability caused by incorrect integer conversion in the NTLM authentication of the CONNECT protocol negotiation. (CVE-2013-1762)

Updated stunnel packages fix security vulnerability :

stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow (CVE-2013-1762).

The updated packages also fixes the following :

  - move library subpackages back into main stunnel package

    - add a systemd unit file (partially fixing Bug 3951)

    - fix issues with stunnel.conf and stunnel.pem, with       stunnel running in a chroot environment.

An updated stunnel package that fixes one security issue is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

stunnel is a socket wrapper which can provide SSL (Secure Sockets Layer) support to ordinary applications. For example, it can be used in conjunction with imapd to create an SSL-secure IMAP server.

An integer conversion issue was found in stunnel when using Microsoft NT LAN Manager (NTLM) authentication with the HTTP CONNECT tunneling method. With this configuration, and using stunnel in SSL client mode on a 64-bit system, an attacker could possibly execute arbitrary code with the privileges of the stunnel process via a man-in-the-middle attack or by tricking a user into using a malicious proxy.
(CVE-2013-1762)

All stunnel users should upgrade to this updated package, which contains a backported patch to correct this issue.

An integer conversion issue was found in stunnel when using Microsoft NT LAN Manager (NTLM) authentication with the HTTP CONNECT tunneling method. With this configuration, and using stunnel in SSL client mode on a 64-bit system, an attacker could possibly execute arbitrary code with the privileges of the stunnel process via a man-in-the-middle attack or by tricking a user into using a malicious proxy.
(CVE-2013-1762)

The version of stunnel installed on the remote host is a version after 4.21 and prior to 4.55. It is, therefore, affected by the following vulnerabilities :

  - The bundled version of OpenSSL contains an error related     to CBC-mode and timing that allows an attacker to     recover plaintext from encrypted communications.
    (CVE-2013-0169)

  - A buffer overflow condition exists related to NTLM     authentication. Note this issue does not affect 32-bit     builds.(CVE-2013-1762)

Michal Trojnara reports :

64-bit versions of stunnel with the following conditions : * NTLM authentication enabled * CONNECT protocol negotiation enabled * Configured in SSL client mode * An attacker that can either control the proxy server specified in the 'connect' option or execute MITM attacks on the TCP session between stunnel and the proxy

Can be exploited for remote code execution. The code is executed within the configured chroot directory, with privileges of the configured user and group.

ID	Name	Product	Family	Type	Severity
289295	MiracleLinux 4 : stunnel-4.29-3.AXS4 (AXSA:2013-374:01)	Nessus	Miracle Linux Local Security Checks	Local	critical
72385	GLSA-201402-08 : stunnel: Arbitrary code execution	Nessus	Gentoo Local Security Checks	Local	medium
68803	Oracle Linux 6 : stunnel (ELSA-2013-0714)	Nessus	Oracle Linux Local Security Checks	Local	critical
66296	Debian DSA-2664-1 : stunnel4 - buffer overflow	Nessus	Debian Local Security Checks	Local	medium
66195	SuSE 11.2 Security Update : stunnel (SAT Patch Number 7449)	Nessus	SuSE Local Security Checks	Local	medium
66142	Mandriva Linux Security Advisory : stunnel (MDVSA-2013:130)	Nessus	Mandriva Local Security Checks	Local	medium
65903	CentOS 6 : stunnel (CESA-2013:0714)	Nessus	CentOS Local Security Checks	Local	medium
65864	Scientific Linux Security Update : stunnel on SL6.x i386/x86_64 (20130408)	Nessus	Scientific Linux Local Security Checks	Local	medium
65863	RHEL 6 : stunnel (RHSA-2013:0714)	Nessus	Red Hat Local Security Checks	Local	medium
65690	stunnel 4.21 - 4.54 Multiple Vulnerabilities	Nessus	Windows	Local	medium
65003	FreeBSD : stunnel -- Remote Code Execution (c97219b6-843d-11e2-b131-000c299b62e1)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2013-1762

critical

Tenable Plugins

critical

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium