Stack-based buffer overflow in the nestlex function in nestlex.c in Socat 1.5.0.0 through 1.7.1.2 and 2.0.0-b1 through 2.0.0-b3, when bidirectional data relay is enabled, allows context-dependent attackers to execute arbitrary code via long command-line arguments.

CVE-2010-2799 Stack-based buffer overflow in the nestlex function in nestlex.c in Socat 1.5.0.0 through 1.7.1.2 and 2.0.0-b1 through 2.0.0-b3, when bidirectional data relay is enabled, allows context-dependent attackers to execute arbitrary code via long command-line arguments.

CVE-2012-0219 Heap-based buffer overflow in the xioscan_readline function in xio-readline.c in socat 1.4.0.0 through 1.7.2.0 and 2.0.0-b1 through 2.0.0-b4 allows local users to execute arbitrary code via the READLINE address.

CVE-2013-3571 socat 1.2.0.0 before 1.7.2.2 and 2.0.0-b1 before 2.0.0-b6, when used for a listen type address and the fork option is enabled, allows remote attackers to cause a denial of service (file descriptor consumption) via multiple request that are refused based on the (1) sourceport, (2) lowport, (3) range, or (4) tcpwrap restrictions.

This update fixes two small security issues in socat :

  - Fixed a stack overflow in commandline parsing     (bnc#627475 / CVE-2010-2799) Only exploitable if an     attacker can control the commandline parameters.

  - Fixed heap overflow in READLINE output mode (bnc#759859     / CVE-2012-0219)

This update fixes two small security issues in socat :

  - Fixed a stack overflow in commandline parsing     (bnc#627475 / CVE-2010-2799) Only exploitable if an     attacker can control the commandline parameters.

  - Fixed heap overflow in READLINE output mode. (bnc#759859     / CVE-2012-0219)

- Upgrade to 1.7.1.3

    - Includes fix for CVE-2010-2799 Stack overflow by       lexical scanning of nested character patterns

    - Resolves       https://bugzilla.redhat.com/show_bug.cgi?id=620430

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This resolves CVE-2010-2799 Socat: Stack overflow by lexical scanning of nested character patterns

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A stack overflow vulnerability was found in socat that allows an attacker to execute arbitrary code with the privileges of the socat process.

This vulnerability can only be exploited when an attacker is able to inject more than 512 bytes of data into socat's argument.

A vulnerable scenario would be a CGI script that reads data from clients and uses (parts of) this data as argument for a socat invocation.

ID	Name	Product	Family	Severity
78159	F5 Networks BIG-IP : Socat vulnerabilities (K14919)	Nessus	F5 Networks Local Security Checks	medium
64225	SuSE 11.1 Security Update : socat (SAT Patch Number 6407)	Nessus	SuSE Local Security Checks	medium
59830	SuSE 10 Security Update : socat (ZYPP Patch Number 8186)	Nessus	SuSE Local Security Checks	medium
52552	Fedora 14 : socat-1.7.1.3-1.fc14 (2011-0098)	Nessus	Fedora Local Security Checks	medium
49060	Fedora 13 : socat-1.7.1.3-1.fc13 (2010-13412)	Nessus	Fedora Local Security Checks	medium
49059	Fedora 12 : socat-1.7.1.3-1.fc12 (2010-13403)	Nessus	Fedora Local Security Checks	medium
48270	Debian DSA-2090-1 : socat - incorrect user-input validation	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2010-2799

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium