dest-unreach / socat / contrib / security advisory 2

Socat security advisory 2

Overview

A stack overflow vulnerability was found that is triggered when command line arguments (complete address specifications, host names, file names) are longer than 512 bytes.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the socat process.

This vulnerability can only be exploited when an attacker is able to inject data into socat's command line.

A vulnerable scenario would be a CGI script that reads data from clients and uses (parts of) this data as hostname for a socat invocation.

The problem was caused by a coding error in function nestlex() that ineffected the output buffer end check.

Vulnerability Ids

CVE-2010-2799

Affected versions

1.5.0.0 - 1.7.1.2

2.0.0-b1 - 2.0.0-b3

Not affected or corrected versions

1.0.0.0 - 1.4.3.1

1.7.1.3 and later

2.0.0-b4 and later

Download

The updated sources can be downloaded from:

• http://www.dest-unreach.org/socat/download/socat-1.7.1.3.tar.gz
• http://www.dest-unreach.org/socat/download/socat-2.0.0-b4.tar gz

Patch to 1.7.1.2:

Patch to 2.0.0-b3:

Credits

Full credits to Felix Gröbert, Google Security Team, for finding and reporting this issue.