Bug 68547 – net-misc/socat: logging format string vulnerability

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Luke Macken (RETIRED) 2004-10-22 07:28:16 UTC]

TITLE:
socat "_msg()" Logging Format String Vulnerability

SECUNIA ADVISORY ID:
SA12936

VERIFY ADVISORY:
http://secunia.com/advisories/12936/

CRITICAL:
Highly critical

IMPACT:
Privilege escalation, System access

WHERE:
From remote

SOFTWARE:
socat 1.x
http://secunia.com/product/4126/

DESCRIPTION:
CoKi has reported a vulnerability in socat, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a format string error in the function "_msg()" in "error.c". This can be exploited to execute arbitrary code when socat is used as a HTTP proxy client and connects to a malicious server. This can also be exploited by a malicious, local user to gain escalated privileges when socat listens on a UNIX domain socket.

Successful exploitation requires that socat logs to syslog ("-ly"
command line option).

SOLUTION:
Update to version 1.4.0.3.
http://www.dest-unreach.org/socat/download/

Do not log to syslog.

PROVIDED AND/OR DISCOVERED BY:
CoKi

ORIGINAL ADVISORY:
Vendor:
http://www.dest-unreach.org/socat/advisory/socat-adv-1.html

CoKi:
http://www.nosystem.com.ar/advisories/advisory-07.txt

[Comment 1 Luke Macken (RETIRED) 2004-10-22 07:33:01 UTC]

vapier,

you bumped this package last, could you please bump it again to 1.4.0.3.

thanks!

[Comment 2 SpanKY 2004-10-22 14:53:27 UTC]

added to cvs as stable for all arches

[Comment 3 Luke Macken (RETIRED) 2004-10-22 21:25:19 UTC]

Ready for GLSA.

[Comment 4 Luke Macken (RETIRED) 2004-10-24 16:29:01 UTC]

GLSA drafted.

security, please review.

[Comment 5 Luke Macken (RETIRED) 2004-10-25 09:13:18 UTC]

GLSA 200410-26