CVE-2013-3571: Low severity dest-unreach Socat vulnerability

Published May 8, 2014

Updated

socat 1.2.0.0 before 1.7.2.2 and 2.0.0-b1 before 2.0.0-b6, when used for a listen type address and the fork option is enabled, allows remote attackers to cause a denial of service (file descriptor consumption) via multiple request that are refused based on the (1) sourceport, (2) lowport, (3) range, or (4) tcpwrap restrictions.

Affected Software

31 affected components

dest-unreach Socat=1.2.0.0

dest-unreach Socat=1.3.0.0

dest-unreach Socat=1.3.0.1

dest-unreach Socat=1.3.1.0

dest-unreach Socat=1.3.2.0

dest-unreach Socat=1.3.2.1

dest-unreach Socat=1.3.2.2

dest-unreach Socat=1.4.0.0

dest-unreach Socat=1.4.0.1

dest-unreach Socat=1.4.0.2

dest-unreach Socat=1.4.0.3

dest-unreach Socat=1.4.1.0

dest-unreach Socat=1.4.2.0

dest-unreach Socat=1.4.3.0

dest-unreach Socat=1.4.3.1

dest-unreach Socat=1.5.0.0

dest-unreach Socat=1.6.0.0

dest-unreach Socat=1.6.0.1

dest-unreach Socat=1.7.0.0

dest-unreach Socat=1.7.0.1

dest-unreach Socat=1.7.1.0

dest-unreach Socat=1.7.1.1

dest-unreach Socat=1.7.1.2

dest-unreach Socat=1.7.1.3

dest-unreach Socat=1.7.2.0

dest-unreach Socat=1.7.2.1

dest-unreach Socat=2.0.0-b1

dest-unreach Socat=2.0.0-b2

dest-unreach Socat=2.0.0-b3

dest-unreach Socat=2.0.0-b4

dest-unreach Socat=2.0.0-b5

Event History

May 8, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Data Sourced

via NVD·02:29 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2013-3571?

CVE-2013-3571 has a medium severity rating, primarily causing denial of service through file descriptor consumption.

How do I fix CVE-2013-3571?

To mitigate CVE-2013-3571, upgrade socat to version 1.7.2.2 or later, or 2.0.0-b6 or later.

What versions of socat are affected by CVE-2013-3571?

CVE-2013-3571 affects socat versions prior to 1.7.2.2 and 2.0.0-b6.

What are the consequences of exploiting CVE-2013-3571?

Exploitation of CVE-2013-3571 can lead to denial of service, causing the application to exhaust file descriptors.

Is there a workaround for CVE-2013-3571?

A possible workaround for CVE-2013-3571 is to disable the fork option in socat if upgrading is not feasible.