dest-unreach / socat / contrib / security advisory 8
A stack overflow vulnerability was found that can be triggered when command line arguments (complete address specifications, host names, file names) are longer than 512 bytes.
Successful exploitation might allow an attacker to execute arbitrary code with the privileges of the socat process.
This vulnerability can only be exploited when an attacker is able to inject data into socat's command line.
A vulnerable scenario would be a CGI script that reads data from clients and uses (parts of) this data as hostname for a Socat invocation.
Socat security issue 8
1.5.0.0 - 1.7.3.0
2.0.0-b1 - 2.0.0-b8
1.0.0.0 - 1.4.3.1
1.7.3.1 and later
2.0.0-b9 and later
Do not pass unfiltered data from untrusted sources to socat's command line
The updated sources can be downloaded from:
Patch to 1.7.3.0:
http://www.dest-unreach.org/socat/download/socat-1.7.3.1.patchPatch to 2.0.0-b8:
http://www.dest-unreach.org/socat/download/socat-2.0.0-b9.patchCredits to Takume Akiyma for finding and reporting this issue.