Detections
Analytics
FreeBSD : libproxy -- stack-based buffer overflow (3b5c2362-bd07-11e5-b7ef-5453ed2e2b49)
critical Nessus Plugin ID 87982
Language:
Synopsis
The remote FreeBSD host is missing one or more security-related updates.Description
Tomas Hoger reports :A buffer overflow flaw was discovered in the libproxy's url::get_pac() used to download proxy.pac proxy auto-configuration file. A malicious host hosting proxy.pac, or a man in the middle attacker, could use this flaw to trigger a stack-based buffer overflow in an application using libproxy, if proxy configuration instructed it to download proxy.pac file from a remote HTTP server.
Solution
Update the affected packages.See Also
https://nvd.nist.gov/vuln/detail/CVE-2012-4504
https://www.openwall.com/lists/oss-security/2012/10/12/1
http://www.nessus.org/u?ef5c1679
https://bugzilla.redhat.com/show_bug.cgi?id=864417
Plugin Details
Severity: Critical
ID: 87982
File Name: freebsd_pkg_3b5c2362bd0711e5b7ef5453ed2e2b49.nasl
Version: 2.6
Type: local
Family: FreeBSD Local Security Checks
Published: 1/19/2016
Updated: 1/4/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:freebsd:freebsd:libproxy, p-cpe:/a:freebsd:freebsd:libproxy-gnome, p-cpe:/a:freebsd:freebsd:libproxy-kde, p-cpe:/a:freebsd:freebsd:libproxy-perl, p-cpe:/a:freebsd:freebsd:libproxy-webkit, cpe:/o:freebsd:freebsd
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Patch Publication Date: 1/17/2016
Vulnerability Publication Date: 10/10/2012
Reference Information
CVE: CVE-2012-4504