stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow.

The remote host is affected by the vulnerability described in GLSA-201402-08 (stunnel: Arbitrary code execution)

    A buffer overflow vulnerability has been discovered in stunnel. Please       review the CVE identifier referenced below for details.
  Impact :

    A remote attacker could entice a user to connect to a malicious proxy       server, resulting in the execution of arbitrary code within the       configured chroot directory, with the privileges of the user running       stunnel. Please review the references below for details.
  Workaround :

    There is no known workaround at this time.

From Red Hat Security Advisory 2013:0714 :

An updated stunnel package that fixes one security issue is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

stunnel is a socket wrapper which can provide SSL (Secure Sockets Layer) support to ordinary applications. For example, it can be used in conjunction with imapd to create an SSL-secure IMAP server.

An integer conversion issue was found in stunnel when using Microsoft NT LAN Manager (NTLM) authentication with the HTTP CONNECT tunneling method. With this configuration, and using stunnel in SSL client mode on a 64-bit system, an attacker could possibly execute arbitrary code with the privileges of the stunnel process via a man-in-the-middle attack or by tricking a user into using a malicious proxy.
(CVE-2013-1762)

All stunnel users should upgrade to this updated package, which contains a backported patch to correct this issue.

Stunnel, a program designed to work as an universal SSL tunnel for network daemons, is prone to a buffer overflow vulnerability when using the Microsoft NT LAN Manager (NTLM) authentication ('protocolAuthentication = NTLM') together with the 'connect'protocol method ('protocol = connect'). With these prerequisites and using stunnel4 in SSL client mode ('client = yes') on a 64 bit host, an attacker could possibly execute arbitrary code with the privileges of the stunnel process, if the attacker can either control the specified proxy server or perform man-in-the-middle attacks on the tcp session between stunnel and the proxy sever.

Note that for the testing distribution (wheezy) and the unstable distribution (sid), stunnel4 is compiled with stack smashing protection enabled, which should help protect against arbitrary code execution.

This update for stunnel fixes a buffer overflow vulnerability caused by incorrect integer conversion in the NTLM authentication of the CONNECT protocol negotiation. (CVE-2013-1762)

Updated stunnel packages fix security vulnerability :

stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow (CVE-2013-1762).

The updated packages also fixes the following :

  - move library subpackages back into main stunnel package

    - add a systemd unit file (partially fixing Bug 3951)

    - fix issues with stunnel.conf and stunnel.pem, with       stunnel running in a chroot environment.

An updated stunnel package that fixes one security issue is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

stunnel is a socket wrapper which can provide SSL (Secure Sockets Layer) support to ordinary applications. For example, it can be used in conjunction with imapd to create an SSL-secure IMAP server.

An integer conversion issue was found in stunnel when using Microsoft NT LAN Manager (NTLM) authentication with the HTTP CONNECT tunneling method. With this configuration, and using stunnel in SSL client mode on a 64-bit system, an attacker could possibly execute arbitrary code with the privileges of the stunnel process via a man-in-the-middle attack or by tricking a user into using a malicious proxy.
(CVE-2013-1762)

All stunnel users should upgrade to this updated package, which contains a backported patch to correct this issue.

An integer conversion issue was found in stunnel when using Microsoft NT LAN Manager (NTLM) authentication with the HTTP CONNECT tunneling method. With this configuration, and using stunnel in SSL client mode on a 64-bit system, an attacker could possibly execute arbitrary code with the privileges of the stunnel process via a man-in-the-middle attack or by tricking a user into using a malicious proxy.
(CVE-2013-1762)

The version of stunnel installed on the remote host is a version after 4.21 and prior to 4.55. It is, therefore, affected by the following vulnerabilities :

  - The bundled version of OpenSSL contains an error related     to CBC-mode and timing that allows an attacker to     recover plaintext from encrypted communications.
    (CVE-2013-0169)

  - A buffer overflow condition exists related to NTLM     authentication. Note this issue does not affect 32-bit     builds.(CVE-2013-1762)

Michal Trojnara reports :

64-bit versions of stunnel with the following conditions : * NTLM authentication enabled * CONNECT protocol negotiation enabled * Configured in SSL client mode * An attacker that can either control the proxy server specified in the 'connect' option or execute MITM attacks on the TCP session between stunnel and the proxy

Can be exploited for remote code execution. The code is executed within the configured chroot directory, with privileges of the configured user and group.

ID	Name	Product	Family	Severity
72385	GLSA-201402-08 : stunnel: Arbitrary code execution	Nessus	Gentoo Local Security Checks	medium
68803	Oracle Linux 6 : stunnel (ELSA-2013-0714)	Nessus	Oracle Linux Local Security Checks	medium
66296	Debian DSA-2664-1 : stunnel4 - buffer overflow	Nessus	Debian Local Security Checks	medium
66195	SuSE 11.2 Security Update : stunnel (SAT Patch Number 7449)	Nessus	SuSE Local Security Checks	medium
66142	Mandriva Linux Security Advisory : stunnel (MDVSA-2013:130)	Nessus	Mandriva Local Security Checks	medium
65903	CentOS 6 : stunnel (CESA-2013:0714)	Nessus	CentOS Local Security Checks	medium
65864	Scientific Linux Security Update : stunnel on SL6.x i386/x86_64 (20130408)	Nessus	Scientific Linux Local Security Checks	medium
65863	RHEL 6 : stunnel (RHSA-2013:0714)	Nessus	Red Hat Local Security Checks	medium
65690	stunnel 4.21 - 4.54 Multiple Vulnerabilities	Nessus	Windows	medium
65003	FreeBSD : stunnel -- Remote Code Execution (c97219b6-843d-11e2-b131-000c299b62e1)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2013-1762

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium