A buffer overflow flaw was discovered in the libproxy's url::get_pac() used to download proxy.pac proxy auto-configuration file. A malicious host hosting proxy.pac, or a man in the middle attacker, could use this flaw to trigger a stack-based buffer overflow in an application using libproxy, if proxy configuration instructed it to download proxy.pac file from a remote HTTP server.
url::get_pac() uses a fixed size buffer buffer to store content of the proxy.pac file downloaded from a remote server. When filling the buffer, it uses server-supplied content length value, rather than size buffer, as a limit for the size of the input copied into the buffer. Overflow occurs when server provides sufficiently large file and does not use chunked content encoding. The buffer size is checked when using chunked encoding.
This issue was introduced upstream with the addition of the chunked encoding support, which first appears in version 0.4.
Created attachment 624045 [details]
Patch from Nicolas Dufresne, moving the content length value check to appear on a non-chunked encoding code path.
Not vulnerable. This issue did not affect the version of libproxy as shipped with Red Hat Enterprise Linux 6.
This issue was discovered by Tomas Mraz of Red Hat.
Fixed now in upstream version 0.4.9. Upstream commit, identical to the patch in comment #1:
Upstream announcement of 0.4.9, also mentioning CVE-2012-4505 (bug 864612):
Upstream 0.4.10 is now released too, which also fixes an infinite loop flaw that can be triggered by a server serving proxy.pac file.
which fixes previous incorrect fix for the issue included in 0.4.9:
Created libproxy tracking bugs for this issue
Affects: fedora-all [bug 866991]
libproxy-0.4.10-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.