CVE-2012-4415: Buffer Overflow
A stack based buffer overflow flaw was found in guac client plug-in protocol handling functionality of libguac, a common library used by all C components of Guacamole. A remote attacker could provide a specially-crafted protocol specification to the guac client plug-in that, when processed would lead to guac client crash (denial of service).
References: [1] http://www.openwall.com/lists/oss-security/2012/09/11/3 [2] http://www.openwall.com/lists/oss-security/2012/09/11/7
Upstream patch: [3] http://guac-dev.org/trac/changeset/7dcefa744b4a38825619c00ae8b47e5bae6e38c0/libguac
Other sources
Stack-based buffer overflow in the guacclientpluginopen function in libguac in Guacamole before 0.6.3 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long protocol name.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4415?
CVE-2012-4415 has a moderate severity rating due to the potential for a remote attacker to exploit a stack-based buffer overflow.
How do I fix CVE-2012-4415?
To fix CVE-2012-4415, upgrade to a non-vulnerable version of Guacamole, specifically version 0.6.3 or later.
What systems are affected by CVE-2012-4415?
CVE-2012-4415 affects Fedora versions 16 and 17, along with Guacamole versions up to and including 0.6.2.
Can CVE-2012-4415 be exploited remotely?
Yes, CVE-2012-4415 can be exploited remotely if a user processes specially-crafted protocol specifications.
What is the nature of the vulnerability in CVE-2012-4415?
CVE-2012-4415 is a stack-based buffer overflow vulnerability found in the protocol handling functionality of the libguac library.