dest-unreach / socat / contrib / security advisory 3
A heap based buffer overflow vulnerability has been found with data that happens to be output on the READLINE address.
Successful exploitation may allow an attacker to execute arbitrary code with the privileges of the socat process.
This vulnerability can be exploited when socat is invoked with the READLINE address (this is usually only used interactively) without option "prompt" and without option "noprompt" and an attacker succeeds to provide malicious data to the other (arbitrary) address that is then transferred by socat to the READLINE address for output.
The problem was caused by a coding error in function xioscan_readline().
To check your socat program do the following:
perl -e 'print "\r"."A"x 513' </tmp/socat-data socat readline exec:'cat /tmp/socat-data'
When socat crashes with a signal (e.g. SIGSEGV) and does not output any 'A' it is vulnerable.
Use option prompt or option noprompt with the READLINE address.
188.8.131.52 - 184.108.40.206
2.0.0-b1 - 2.0.0-b4
220.127.116.11 - 18.104.22.168
22.214.171.124 and later
2.0.0-b5 and later
The updated sources can be downloaded from:
Patch to 126.96.36.199:
Patch to 2.0.0-b4:
2012/04/22 vulnerability report received
2012/04/22 fix to 188.8.131.52 generated
2012/04/27 fix to 2.0.0-b4 generated
2012/05/14 fixes published
Full credits to Johan Thillemann for finding and reporting this issue.