CVE-2012-4504: Buffer Overflow
First published: Tue Oct 09 2012(Updated: )
A buffer overflow flaw was discovered in the libproxy's url::get_pac() used to download proxy.pac proxy auto-configuration file. A malicious host hosting proxy.pac, or a man in the middle attacker, could use this flaw to trigger a stack-based buffer overflow in an application using libproxy, if proxy configuration instructed it to download proxy.pac file from a remote HTTP server. url::get_pac() uses a fixed size buffer buffer[] to store content of the proxy.pac file downloaded from a remote server. When filling the buffer, it uses server-supplied content length value, rather than size buffer, as a limit for the size of the input copied into the buffer. Overflow occurs when server provides sufficiently large file and does not use chunked content encoding. The buffer size is checked when using chunked encoding. <a href="http://code.google.com/p/libproxy/source/browse/trunk/libproxy/url.cpp?r=846#462">http://code.google.com/p/libproxy/source/browse/trunk/libproxy/url.cpp?r=846#462</a> This issue was introduced upstream with the addition of the chunked encoding support, which first appears in version 0.4. <a href="http://code.google.com/p/libproxy/source/detail?r=489">http://code.google.com/p/libproxy/source/detail?r=489</a> <a href="http://code.google.com/p/libproxy/issues/detail?id=77">http://code.google.com/p/libproxy/issues/detail?id=77</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/libproxy | <0.4.9 | 0.4.9 |
| Libproxy Project Libproxy | =0.4.0 | |
| Libproxy Project Libproxy | =0.4.1 | |
| Libproxy Project Libproxy | =0.4.2 | |
| Libproxy Project Libproxy | =0.4.3 | |
| Libproxy Project Libproxy | =0.4.5 | |
| Libproxy Project Libproxy | =0.4.6 | |
| Libproxy Project Libproxy | =0.4.7 | |
| Libproxy Project Libproxy | =0.4.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://code.google.com/p/libproxy/source/browse/trunk/libproxy/url.cpp?r=846#462
- http://code.google.com/p/libproxy/source/detail?r=489
- http://code.google.com/p/libproxy/issues/detail?id=77
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=624045&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=624045&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=864417#c1
- https://code.google.com/p/libproxy/source/detail?r=853
- https://access.redhat.com/security/cve/CVE-2012-4505
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=864612
- https://groups.google.com/forum/?fromgroups=#!topic/libproxy/VxZ8No7mT0E
- https://groups.google.com/forum/?fromgroups=#!topic/libproxy/DsXENAx6LT8
- https://code.google.com/p/libproxy/source/detail?r=859
- https://code.google.com/p/libproxy/source/detail?r=854
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=866991
- https://bugzilla.redhat.com/show_bug.cgi?id=864417
- http://code.google.com/p/libproxy/source/detail?r=853
- http://lists.opensuse.org/opensuse-updates/2012-10/msg00065.html
- http://secunia.com/advisories/51048
- http://www.openwall.com/lists/oss-security/2012/10/12/1
- http://www.openwall.com/lists/oss-security/2012/10/12/5
- http://www.openwall.com/lists/oss-security/2012/10/16/3
- http://www.securityfocus.com/bid/55909
- http://www.ubuntu.com/usn/USN-1629-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/79249
- collector/redhat-bugzilla
- alias/CVE-2012-4504
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/tags
- agent/description
- agent/type
- agent/event
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- package-manager/redhat
- vendor/libproxy project
- canonical/libproxy project libproxy
- version/libproxy project libproxy/0.4.0
- version/libproxy project libproxy/0.4.1
- version/libproxy project libproxy/0.4.2
- version/libproxy project libproxy/0.4.3
- version/libproxy project libproxy/0.4.5
- version/libproxy project libproxy/0.4.6
- version/libproxy project libproxy/0.4.7
- version/libproxy project libproxy/0.4.8