Heap-based buffer overflow in the xioscan_readline function in xio-readline.c in socat 1.4.0.0 through 1.7.2.0 and 2.0.0-b1 through 2.0.0-b4 allows local users to execute arbitrary code via the READLINE address.

CVE-2010-2799 Stack-based buffer overflow in the nestlex function in nestlex.c in Socat 1.5.0.0 through 1.7.1.2 and 2.0.0-b1 through 2.0.0-b3, when bidirectional data relay is enabled, allows context-dependent attackers to execute arbitrary code via long command-line arguments.

CVE-2012-0219 Heap-based buffer overflow in the xioscan_readline function in xio-readline.c in socat 1.4.0.0 through 1.7.2.0 and 2.0.0-b1 through 2.0.0-b4 allows local users to execute arbitrary code via the READLINE address.

CVE-2013-3571 socat 1.2.0.0 before 1.7.2.2 and 2.0.0-b1 before 2.0.0-b6, when used for a listen type address and the fork option is enabled, allows remote attackers to cause a denial of service (file descriptor consumption) via multiple request that are refused based on the (1) sourceport, (2) lowport, (3) range, or (4) tcpwrap restrictions.

This update of socat fixes a buffer overflow in READLINE output mode.

Updated socat package fixes security vulnerability :

Heap-based buffer overflow in the xioscan_readline function in xio-readline.c in socat 1.4.0.0 through 1.7.2.0 and 2.0.0-b1 through 2.0.0-b4 allows local users to execute arbitrary code via the READLINE address (CVE-2012-0219).

This update fixes two small security issues in socat :

  - Fixed a stack overflow in commandline parsing     (bnc#627475 / CVE-2010-2799) Only exploitable if an     attacker can control the commandline parameters.

  - Fixed heap overflow in READLINE output mode (bnc#759859     / CVE-2012-0219)

The remote host is affected by the vulnerability described in GLSA-201208-01 (socat: Arbitrary code execution)

    A vulnerability in the 'xioscan_readline()' function in xio-readline.c       could cause a heap-based buffer overflow.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the socat process.
  Workaround :

    There is no known workaround at this time.

This update fixes two small security issues in socat :

  - Fixed a stack overflow in commandline parsing     (bnc#627475 / CVE-2010-2799) Only exploitable if an     attacker can control the commandline parameters.

  - Fixed heap overflow in READLINE output mode. (bnc#759859     / CVE-2012-0219)

Fix for CVE-2012-0219 heap-based buffer overflow

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The socat development team reports :

This vulnerability can be exploited when socat is invoked with the READLINE address (this is usually only used interactively) without option 'prompt' and without option 'noprompt' and an attacker succeeds to provide malicious data to the other (arbitrary) address that is then transferred by socat to the READLINE address for output.

Successful exploitation may allow an attacker to execute arbitrary code with the privileges of the socat process.

ID	Name	Product	Family	Severity
78159	F5 Networks BIG-IP : Socat vulnerabilities (K14919)	Nessus	F5 Networks Local Security Checks	medium
74659	openSUSE Security Update : socat (openSUSE-SU-2012:0809-1)	Nessus	SuSE Local Security Checks	medium
69694	Amazon Linux AMI : socat (ALAS-2012-87)	Nessus	Amazon Linux Local Security Checks	medium
66139	Mandriva Linux Security Advisory : socat (MDVSA-2013:127)	Nessus	Mandriva Local Security Checks	medium
64225	SuSE 11.1 Security Update : socat (SAT Patch Number 6407)	Nessus	SuSE Local Security Checks	medium
61540	GLSA-201208-01 : socat: Arbitrary code execution	Nessus	Gentoo Local Security Checks	medium
59830	SuSE 10 Security Update : socat (ZYPP Patch Number 8186)	Nessus	SuSE Local Security Checks	medium
59389	Fedora 16 : socat-1.7.2.1-1.fc16 (2012-8328)	Nessus	Fedora Local Security Checks	medium
59334	Fedora 17 : socat-1.7.2.1-1.fc17 (2012-8274)	Nessus	Fedora Local Security Checks	medium
59095	FreeBSD : socat -- Heap-based buffer overflow (6601127c-9e09-11e1-b5e0-000c299b62e1)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-0219

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium