Bug 864417 - (CVE-2012-4504) CVE-2012-4504 libproxy: long proxy.pac file handling buffer overflow
CVE-2012-4504 libproxy: long proxy.pac file handling buffer overflow
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20121010,repor...
: Security
Depends On: 866991
Blocks: 864423
  Show dependency treegraph
 
Reported: 2012-10-09 07:53 EDT by Tomas Hoger
Modified: 2012-11-18 21:19 EST (History)
2 users (show)

See Also:
Fixed In Version: libproxy 0.4.9
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
Upstream patch (536 bytes, patch)
2012-10-09 07:55 EDT, Tomas Hoger
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Novell 784523 None None None 2012-10-11 16:02:53 EDT

  None (edit)
Description Tomas Hoger 2012-10-09 07:53:33 EDT
A buffer overflow flaw was discovered in the libproxy's url::get_pac() used to download proxy.pac proxy auto-configuration file.  A malicious host hosting proxy.pac, or a man in the middle attacker, could use this flaw to trigger a stack-based buffer overflow in an application using libproxy, if proxy configuration instructed it to download proxy.pac file from a remote HTTP server.

url::get_pac() uses a fixed size buffer buffer[] to store content of the proxy.pac file downloaded from a remote server.  When filling the buffer, it uses server-supplied content length value, rather than size buffer, as a limit for the size of the input copied into the buffer.  Overflow occurs when server provides sufficiently large file and does not use chunked content encoding.  The buffer size is checked when using chunked encoding.

http://code.google.com/p/libproxy/source/browse/trunk/libproxy/url.cpp?r=846#462

This issue was introduced upstream with the addition of the chunked encoding support, which first appears in version 0.4.

http://code.google.com/p/libproxy/source/detail?r=489
http://code.google.com/p/libproxy/issues/detail?id=77
Comment 1 Tomas Hoger 2012-10-09 07:55:57 EDT
Created attachment 624045 [details]
Upstream patch

Patch from Nicolas Dufresne, moving the content length value check to appear on a non-chunked encoding code path.
Comment 3 Tomas Hoger 2012-10-09 08:00:35 EDT
Statement:

Not vulnerable. This issue did not affect the version of libproxy as shipped with Red Hat Enterprise Linux 6.
Comment 4 Tomas Hoger 2012-10-09 14:51:07 EDT
Acknowledgment:

This issue was discovered by Tomas Mraz of Red Hat.
Comment 6 Tomas Hoger 2012-10-11 16:02:53 EDT
Fixed now in upstream version 0.4.9.  Upstream commit, identical to the patch in comment #1:

https://code.google.com/p/libproxy/source/detail?r=853
Comment 7 Tomas Hoger 2012-10-12 04:43:10 EDT
Upstream announcement of 0.4.9, also mentioning CVE-2012-4505 (bug 864612):

https://groups.google.com/forum/?fromgroups=#!topic/libproxy/VxZ8No7mT0E
Comment 8 Tomas Hoger 2012-10-16 09:45:20 EDT
Upstream 0.4.10 is now released too, which also fixes an infinite loop flaw that can be triggered by a server serving proxy.pac file.

https://groups.google.com/forum/?fromgroups=#!topic/libproxy/DsXENAx6LT8

Relevant change:

https://code.google.com/p/libproxy/source/detail?r=859

which fixes previous incorrect fix for the issue included in 0.4.9:

https://code.google.com/p/libproxy/source/detail?r=854
Comment 9 Tomas Hoger 2012-10-16 09:46:35 EDT
Created libproxy tracking bugs for this issue

Affects: fedora-all [bug 866991]
Comment 10 Fedora Update System 2012-11-18 21:19:29 EST
libproxy-0.4.10-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.