Stack-based buffer overflow in socat 1.3.0.0 through 1.7.2.2 and 2.0.0-b1 through 2.0.0-b6 allows local users to cause a denial of service (segmentation fault) via a long server name in the PROXY-CONNECT address in the command line.

socat was updated 1.7.2.4 to fix one security issue and bugs.

The following vulnerabilities were fixed :

  - socats PROXY-CONNECT address was vulnerable to a buffer     overflow with data from command line (CVE-2014-0019,     boo#860991)

The following bugs were fixed :

  - socat would frequently crash on ppc and armv7l     (boo#927161)

  - various other bug fixes in 1.7.2.4

A vulnerability has been discovered and corrected in socat :

Stack-based buffer overflow in socat 1.3.0.0 through 1.7.2.2 and 2.0.0-b1 through 2.0.0-b6 allows local users to cause a denial of service (segmentation fault) via a long server name in the PROXY-CONNECT address in the command line (CVE-2014-0019).

The updated packages have been upgraded to the 1.7.2.3 version which is not vulnerable to this issue.

Security update for CVE-2014-0019, which fixes a denial of service flaw in socat when using PROXY-CONNECT

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Florian Weimer of the Red Hat Product Security Team reports :

Due to a missing check during assembly of the HTTP request line a long target server name in the PROXY-CONNECT address can cause a stack buffer overrun. Exploitation requires that the attacker is able to provide the target server name to the PROXY-CONNECT address in the command line. This can happen for example in scripts that receive data from untrusted sources.

ID	Name	Product	Family	Severity
83083	openSUSE Security Update : socat (openSUSE-2015-324)	Nessus	SuSE Local Security Checks	low
72948	Amazon Linux AMI : socat (ALAS-2014-300)	Nessus	Amazon Linux Local Security Checks	low
72531	Mandriva Linux Security Advisory : socat (MDVSA-2014:033)	Nessus	Mandriva Local Security Checks	low
72463	Fedora 20 : socat-1.7.2.3-1.fc20 (2014-1811)	Nessus	Fedora Local Security Checks	low
72462	Fedora 19 : socat-1.7.2.3-1.fc19 (2014-1795)	Nessus	Fedora Local Security Checks	low
72206	FreeBSD : socat -- buffer overflow with data from command line (a4c9e12d-88b7-11e3-8ada-10bf48e1088e)	Nessus	FreeBSD Local Security Checks	low

Detections

Analytics

CVE-2014-0019

medium

Tenable Plugins

low

low

low

low

low

low