CVE-2012-5580: Code Injection
A format string flaw was reported [1] in libproxy's proxy commandline tool (bin/proxy). This was corrected upstream [2] and is included in the 0.4.0 release.
FORTIFYSOURCE turns this into a harmless crash:
% httpproxy=http://foo%n.example.com/ proxy http://example.com %n in writable segment detected http://foozsh: abort (core dumped) httpproxy=http://foo%n.example.com/ proxy http://example.com
NOTE: this flaw exists solely in the proxy tool, not the library.
[1] https://bugzilla.novell.com/showbug.cgi?id=791086 [2] https://code.google.com/p/libproxy/source/detail?r=475
Other sources
Format string vulnerability in the printproxies function in bin/proxy.c in libproxy 0.3.1 might allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in a proxy name, as demonstrated using the httpproxy environment variable or a PAC file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5580?
CVE-2012-5580 has a moderate to high severity level due to the potential for a format string vulnerability.
How do I fix CVE-2012-5580?
To fix CVE-2012-5580, you should upgrade libproxy to version 0.4.0 or later.
Which versions of libproxy are affected by CVE-2012-5580?
CVE-2012-5580 affects libproxy version 0.3.1 and earlier versions.
Is there a workaround for CVE-2012-5580?
No official workaround is recommended for CVE-2012-5580; upgrading is the best solution.
Who reported CVE-2012-5580?
CVE-2012-5580 was reported by a security researcher and discussed in public vulnerability databases.