Published: 08/03/2013 Updated: 17/01/2014

CVSS v2 Base Score: 6.6 | Impact Score: 8.5 | Exploitability Score: 4.9

VMScore: 587

Vector: AV:N/AC:H/Au:N/C:P/I:P/A:C

stunnel 4.21 up to and including 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow.

Vulnerable Product	Search on Vulmon	Subscribe to Product
stunnel stunnel 4.24
stunnel stunnel 4.23
stunnel stunnel 4.33
stunnel stunnel 4.34
stunnel stunnel 4.42
stunnel stunnel 4.43
stunnel stunnel 4.44
stunnel stunnel 4.51
stunnel stunnel 4.52
stunnel stunnel 4.26
stunnel stunnel 4.25
stunnel stunnel 4.31
stunnel stunnel 4.32
stunnel stunnel 4.39
stunnel stunnel 4.41
stunnel stunnel 4.49
stunnel stunnel 4.50
stunnel stunnel 4.40
stunnel stunnel 4.22
stunnel stunnel 4.21
stunnel stunnel 4.35
stunnel stunnel 4.36
stunnel stunnel 4.45
stunnel stunnel 4.46
stunnel stunnel 4.53
stunnel stunnel
stunnel stunnel 4.28
stunnel stunnel 4.27
stunnel stunnel 4.29
stunnel stunnel 4.30
stunnel stunnel 4.37
stunnel stunnel 4.38
stunnel stunnel 4.47
stunnel stunnel 4.48

Synopsis Moderate: stunnel security update Type/Severity Security Advisory: Moderate Topic An updated stunnel package that fixes one security issue is now availablefor Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as having moderatesecurity impact A Common Vulnerabilit ...

Debian Bug report logs - #702267 stunnel: CVE-2013-1762 buffer overflow in NTLM authentication of the CONNECT protocol negotiation Package: stunnel4; Maintainer for stunnel4 is Peter Pentchev <roam@debianorg>; Source for stunnel4 is src:stunnel4 (PTS, buildd, popcon) Reported by: Nico Golde <nion@debianorg> Date: M ...

Stunnel, a program designed to work as an universal SSL tunnel for network daemons, is prone to a buffer overflow vulnerability when using the Microsoft NT LAN Manager (NTLM) authentication (protocolAuthentication = NTLM) together with the connect protocol method (protocol = connect) With these prerequisites and using stunnel4 in SSL client mode ( ...

CWE-94 https://www.stunnel.org/CVE-2013-1762.html http://rhn.redhat.com/errata/RHSA-2013-0714.html http://www.debian.org/security/2013/dsa-2664 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0097 http://www.mandriva.com/security/advisories?name=MDVSA-2013:130 https://access.redhat.com/errata/RHSA-2013:0714 https://nvd.nist.gov https://www.debian.org/security/./dsa-2664

CVE-2013-1762

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect