A stack based buffer overflow vulnerability has been reported in GNOME libsoup 2.58. The flaw is caused due to a boundary error within the "soup_filter_input_stream_read_until()" function when parsing chunk encoded HTTP traffic and affects both the server and client functionality of libsoup. A remote attacker could exploit this flaw to cause a crash or, potentially, execute arbitrary code by sending a specially crafted HTTP request to a server using the libsoup HTTP server functionality or by tricking a user into connecting to a malicious HTTP server with an application using the libsoup HTTP client functionality. Please note that the libsoup packages as shipped with Red Hat Enterprise Linux 7 contain a "stack smashing protection" mitigation for the relevant function, which makes exploitation significantly harder. Thus, in most cases an exploitation attempt should be mitigated to a mere crash. However, successful exploitation to execute arbitrary code can't be ruled out entirely.
Acknowledgments: Name: Aleksandar Nikolic (Cisco Talos)
Statement: This issue affects the libsoup packages as shipped with Red Hat Enterprise Linux 7. However, these packages have been compiled with additional security mitigation techniques ("stack smashing protection"), which makes exploitation significantly harder. Thus, in most cases an exploitation attempt should be mitigated to a mere crash. However, successful exploitation to execute arbitrary code can't be ruled out entirely.
Public via: https://bugzilla.gnome.org/show_bug.cgi?id=785774
Created libsoup tracking bugs for this issue: Affects: fedora-all [bug 1480241] Created mingw-libsoup tracking bugs for this issue: Affects: epel-7 [bug 1480239] Affects: fedora-all [bug 1480240]
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2017:2459 https://access.redhat.com/errata/RHSA-2017:2459
Upstream patch: https://git.gnome.org/browse/libsoup/commit/?id=03c91c76daf70ee227f38304c5e45a155f45073d
External References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0392