REDHAT-BUG-2427906: Buffer Overflow
A stack-based buffer overflow vulnerability exists in the md4sum() function of libsoup’s NTLM authentication module (SoupAuthNTLM). When NTLM authentication is enabled, insufficient bounds checking on stack-allocated buffers can allow a local attacker to overwrite adjacent memory. This may result in arbitrary code execution with the privileges of the affected application. Multiple widely deployed components, including WebKit, Evolution, GVfs, and gnome-online-accounts, enable NTLM by default, increasing exposure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2427906?
The severity of REDHAT-BUG-2427906 is critical due to the potential for local attackers to exploit a stack-based buffer overflow.
How do I fix REDHAT-BUG-2427906?
To fix REDHAT-BUG-2427906, you should update libsoup to the latest patched version provided by your distribution.
What causes the vulnerability REDHAT-BUG-2427906?
REDHAT-BUG-2427906 is caused by insufficient bounds checking in the md4sum() function within libsoup's NTLM authentication module.
Who is affected by REDHAT-BUG-2427906?
Users and applications that enable NTLM authentication in libsoup are affected by REDHAT-BUG-2427906.
Can REDHAT-BUG-2427906 be exploited remotely?
No, REDHAT-BUG-2427906 requires local access for exploitation due to the nature of the stack-based buffer overflow.