An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.

According to the versions of the libsoup package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A stack-based buffer overflow flaw was discovered     within the HTTP processing of libsoup. A remote     attacker could exploit this flaw to cause a crash or,     potentially, execute arbitrary code by sending a     specially crafted HTTP request to a server using the     libsoup HTTP server functionality or by tricking a user     into connecting to a malicious HTTP server with an     application using the libsoup HTTP client     functionality.(CVE-2017-2885)

  - The get_cookies function in soup-cookie-jar.c in     libsoup 2.63.2 allows attackers to have unspecified     impact via an empty hostname.(CVE-2018-12910)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libsoup package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The get_cookies function in soup-cookie-jar.c in     libsoup 2.63.2 allows attackers to have unspecified     impact via an empty hostname.(CVE-2018-12910)

  - A stack-based buffer overflow flaw was discovered     within the HTTP processing of libsoup. A remote     attacker could exploit this flaw to cause a crash or,     potentially, execute arbitrary code by sending a     specially crafted HTTP request to a server using the     libsoup HTTP server functionality or by tricking a user     into connecting to a malicious HTTP server with an     application using the libsoup HTTP client     functionality.(CVE-2017-2885)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the libsoup package has been released.

This update for libsoup fixes the following issues :

Security issue fixed :

CVE-2018-12910: Fix crash when handling empty hostnames (bsc#1100097).

CVE-2017-2885: Fix chunk decoding buffer overrun that could be exploited against either clients or servers (bsc#1052916).

Bug fixes: bsc#1086036: translation-update-upstream commented out for Leap

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libsoup fixes the following issues :

Security issue fixed :

  - CVE-2018-12910: Fix crash when handling empty hostnames     (bsc#1100097).

  - CVE-2017-2885: Fix chunk decoding buffer overrun that     could be exploited against either clients or servers     (bsc#1052916).

Bug fixes :

  - bsc#1086036: translation-update-upstream commented out     for Leap

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for libsoup fixes the following issues: Security issue fixed :

  - CVE-2018-12910: Fix crash when handling empty hostnames     (bsc#1100097).

  - CVE-2017-2885: Fix chunk decoding buffer overrun that     could be exploited against either clients or servers     (bsc#1052916). Bug fixes :

  - bsc#1086036: translation-update-upstream commented out     for Leap

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201709-26 (libsoup: Arbitrary remote code execution)

    A stack based buffer overflow vulnerability was discovered in libsoup.
  Impact :

    A remote attacker, by using specially crafted HTTP requests, could       execute arbitrary code with the privileges of the process.
  Workaround :

    There is no known workaround at this time.

According to the version of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A stack-based buffer overflow flaw was discovered     within the HTTP processing of libsoup. A remote     attacker could exploit this flaw to cause a crash or,     potentially, execute arbitrary code by sending a     specially crafted HTTP request to a server using the     libsoup HTTP server functionality or by tricking a user     into connecting to a malicious HTTP server with an     application using the libsoup HTTP client     functionality. (CVE-2017-2885)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for libsoup is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es) :

* A stack-based buffer overflow flaw was discovered within the HTTP processing of libsoup. A remote attacker could exploit this flaw to cause a crash or, potentially, execute arbitrary code by sending a specially crafted HTTP request to a server using the libsoup HTTP server functionality or by tricking a user into connecting to a malicious HTTP server with an application using the libsoup HTTP client functionality. (CVE-2017-2885)

Red Hat would like to thank Aleksandar Nikolic (Cisco Talos) for reporting this issue.

Security fix for CVE-2017-2885 (stack based buffer overflow with HTTP Chunked Encoding).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - A stack-based buffer overflow flaw was discovered within     the HTTP processing of libsoup. A remote attacker could     exploit this flaw to cause a crash or, potentially,     execute arbitrary code by sending a specially crafted     HTTP request to a server using the libsoup HTTP server     functionality or by tricking a user into connecting to a     malicious HTTP server with an application using the     libsoup HTTP client functionality. (CVE-2017-2885)

Tobias Mueller reports :

libsoup is susceptible to a stack based buffer overflow attack when using chunked encoding. Regardless of libsoup being used as a server or client.

This update for libsoup fixes the following issues :

  - A bug in the HTTP Chunked Encoding code has been fixed     that could have been exploited by attackers to cause a     stack-based buffer overflow in client or server code     running libsoup (bsc#1052916, CVE-2017-2885).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

New libsoup packages are available for Slackware 14.1, 14.2, and
-current to fix a security issue.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3383-1 advisory.

    Aleksandar Nikolic discovered a stack based buffer overflow when handling chunked encoding. An attacker     could use this to cause a denial of service or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libsoup fixes the following issues :

  - A bug in the HTTP Chunked Encoding code has been fixed     that could have been exploited by attackers to cause a     stack-based buffer overflow in client or server code     running libsoup (bsc#1052916, CVE-2017-2885).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2459 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * A stack-based buffer overflow flaw was discovered within the HTTP processing of libsoup. A remote     attacker could exploit this flaw to cause a crash or, potentially, execute arbitrary code by sending a     specially crafted HTTP request to a server using the libsoup HTTP server functionality or by tricking a     user into connecting to a malicious HTTP server with an application using the libsoup HTTP client     functionality. (CVE-2017-2885)

    Red Hat would like to thank Aleksandar Nikolic (Cisco Talos) for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-2459 advisory.

    [2.56.0-4]
    - Fix chunked decoding buffer overrun (CVE-2017-2885) (rh #1479322)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Aleksandar Nikolic of Cisco Talos discovered a stack-based buffer overflow vulnerability in libsoup2.4, a HTTP library implementation in C. A remote attacker can take advantage of this flaw by sending a specially crafted HTTP request to cause an application using the libsoup2.4 library to crash (denial of service), or potentially execute arbitrary code.

ID	Name	Product	Family	Severity
140995	EulerOS Virtualization for ARM 64 3.0.6.0 : libsoup (EulerOS-SA-2020-2047)	Nessus	Huawei Local Security Checks	critical
124895	EulerOS Virtualization for ARM 64 3.0.1.0 : libsoup (EulerOS-SA-2019-1392)	Nessus	Huawei Local Security Checks	critical
121957	Photon OS 2.0: Libsoup PHSA-2018-2.0-0060	Nessus	PhotonOS Local Security Checks	critical
121847	Photon OS 1.0: Libsoup PHSA-2018-1.0-0149	Nessus	PhotonOS Local Security Checks	critical
121042	SUSE SLES12 Security Update : libsoup (SUSE-SU-2018:2204-2)	Nessus	SuSE Local Security Checks	critical
111637	openSUSE Security Update : libsoup (openSUSE-2018-856)	Nessus	SuSE Local Security Checks	critical
111574	SUSE SLED12 / SLES12 Security Update : libsoup (SUSE-SU-2018:2204-1)	Nessus	SuSE Local Security Checks	critical
103485	GLSA-201709-26 : libsoup: Arbitrary remote code execution	Nessus	Gentoo Local Security Checks	critical
103068	EulerOS 2.0 SP2 : libsoup (EulerOS-SA-2017-1210)	Nessus	Huawei Local Security Checks	critical
103067	EulerOS 2.0 SP1 : libsoup (EulerOS-SA-2017-1209)	Nessus	Huawei Local Security Checks	critical
102764	CentOS 7 : libsoup (CESA-2017:2459)	Nessus	CentOS Local Security Checks	critical
102721	Fedora 25 : mingw-libsoup (2017-c9d8011d69)	Nessus	Fedora Local Security Checks	critical
102670	Scientific Linux Security Update : libsoup on SL7.x x86_64 (20170815)	Nessus	Scientific Linux Local Security Checks	critical
102631	Fedora 26 : mingw-libsoup (2017-1f4c82d73e)	Nessus	Fedora Local Security Checks	critical
102553	FreeBSD : libsoup -- stack based buffer overflow (8e7bbddd-8338-11e7-867f-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	critical
102468	openSUSE Security Update : libsoup (openSUSE-2017-914)	Nessus	SuSE Local Security Checks	critical
102460	Fedora 26 : libsoup (2017-b0ec173bd1)	Nessus	Fedora Local Security Checks	critical
102457	Fedora 25 : libsoup (2017-872a0a9a85)	Nessus	Fedora Local Security Checks	critical
102433	Slackware 14.1 / 14.2 / current : libsoup (SSA:2017-223-02)	Nessus	Slackware Local Security Checks	critical
102417	Ubuntu 14.04 LTS / 16.04 LTS : libsoup vulnerability (USN-3383-1)	Nessus	Ubuntu Local Security Checks	critical
102414	SUSE SLES12 Security Update : libsoup (SUSE-SU-2017:2130-1)	Nessus	SuSE Local Security Checks	critical
102413	SUSE SLED12 / SLES12 Security Update : libsoup (SUSE-SU-2017:2129-1)	Nessus	SuSE Local Security Checks	critical
102412	RHEL 7 : libsoup (RHSA-2017:2459)	Nessus	Red Hat Local Security Checks	critical
102409	Oracle Linux 7 : libsoup (ELSA-2017-2459)	Nessus	Oracle Linux Local Security Checks	critical
102370	Debian DSA-3929-1 : libsoup2.4 - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-2885

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical