libproxy: CVE-2020-26154: buffer overflow when PAC is enabled

Debian Bug report logs - #968366
libproxy: CVE-2020-26154: buffer overflow when PAC is enabled

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libproxy#126: buffer overflow when PAC is enabled

Date: Thu, 13 Aug 2020 16:36:59 +0100

Source: libproxy
Version: 0.4.14-2
Severity: grave
Justification: user security hole
Tags: security upstream
Forwarded: https://github.com/libproxy/libproxy/pull/126
X-Debbugs-Cc: Debian Security Team <team@security.debian.org>

Li Fei (@lifeibiren on Github) reported that if the server serving a PAC
file sends more than 102400 bytes without a Content-Length present,
libproxy can overflow its buffer by PAC_HTTP_BLOCK_SIZE (512) bytes.

This PR is said to fix it, although I have not reviewed it in detail, and
it would be better if someone who knows C++ better than me did the review:

https://github.com/libproxy/libproxy/pull/126

Thanks to Michael Catanzaro for highlighting this as likely to be a
security vulnerability during a more general conversation about libproxy.

(Please reduce severity as desired if this is succesfully mitigated by
some security measure - I'm assuming stack smashing is arbitrary code
execution, but maybe it's just DoS.)

From source code inspection, versions >= 0.4.14-2 in stretch appear
to be vulnerable. 0.4.11-4 in jessie does not appear to be vulnerable,
because it assumes absence of Content-Length means a length of 0 (which
is a bug, but not a security bug). Intermediate versions between jessie
and stretch not checked.

    smcv

Send a report that this bug log contains spam.