Bug 1057746 (CVE-2014-0019)

Summary: CVE-2014-0019 socat: PROXY-CONNECT address overflow
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: bleanhar, ccoleman, dmcphers, jdetiber, jialiu, jrusnack, lmeyer, pfrields, pwouters, security-response-team, vkrizan
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=low,public=20140128,reported=20131022,source=redhat,cvss2=2.6/AV:N/AC:H/Au:N/C:N/I:N/A:P,fedora-all/socat=affected,epel-all/socat=affected,rhel-7/socat=notaffected,openshift-enterprise-2/socat=affected,cwe=CWE-119
Fixed In Version: socat 1.7.2.3, socat 2.0.0b7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-07-18 00:32:16 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1057748, 1058996, 1081919    
Bug Blocks: 1057751    
Attachments:
Description Flags
upstream patch to correct the flaw none

Description Vincent Danen 2014-01-24 17:54:26 UTC
Florian Weimer of the Red Hat Product Security Team discovered a denial of service flaw in socat. Due to a missing check during assembly of the HTTP request line a long target server name (<hostname> in the documentation) of the PROXY-CONNECT address can cause a stack buffer overrun. Exploitation requires that the attacker is able to provide the target server name to the PROXY-CONNECT address in the command line. This can happen for example in scripts that receive data from untrusted sources.

This flaw affects socat versions 1.3.0.0 through to 1.7.2.2; it is corrected in 1.7.2.3.


Acknowledgements:

This issue was discovered by Florian Weimer of the Red Hat Product Security Team.

Comment 2 Vincent Danen 2014-01-24 17:56:33 UTC
Created attachment 855124 [details]
upstream patch to correct the flaw

Comment 4 Vincent Danen 2014-01-28 23:28:05 UTC
This issue is now public:

http://seclists.org/oss-sec/2014/q1/159

Comment 5 Vincent Danen 2014-01-28 23:30:16 UTC
Created socat tracking bugs for this issue:

Affects: fedora-all [bug 1058996]

Comment 6 Fedora Update System 2014-02-12 14:38:49 UTC
socat-1.7.2.3-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2014-02-12 14:52:31 UTC
socat-1.7.2.3-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2014-02-20 07:02:08 UTC
socat-1.7.2.3-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Kurt Seifried 2014-07-18 00:25:51 UTC
Statement:

The Red Hat Security Response Team has rated this issue as having Low security impact on OpenShift Enterprise, a future update may address this flaw.