dest-unreach / socat / contrib / security advisory 2
A stack overflow vulnerability was found that is triggered when command line arguments (complete address specifications, host names, file names) are longer than 512 bytes.
Successful exploitation allows an attacker to execute arbitrary code with the privileges of the socat process.
This vulnerability can only be exploited when an attacker is able to inject data into socat's command line.
A vulnerable scenario would be a CGI script that reads data from clients and uses (parts of) this data as hostname for a socat invocation.
The problem was caused by a coding error in function nestlex() that ineffected the output buffer end check.
CVE-2010-2799
1.5.0.0 - 1.7.1.2
2.0.0-b1 - 2.0.0-b3
1.0.0.0 - 1.4.3.1
1.7.1.3 and later
2.0.0-b4 and later
The updated sources can be downloaded from:
Patch to 1.7.1.2:
http://www.dest-unreach.org/socat/download/socat-1.7.1.3.patchPatch to 2.0.0-b3:
http://www.dest-unreach.org/socat/download/socat-2.0.0-b4.patchFull credits to Felix Gröbert, Google Security Team, for finding and reporting this issue.