CVE-2012-4504
published 2012-11-11CVE-2012-4504: Stack-based buffer overflow in the url::get_pac function in url.cpp in libproxy 0.4.x before 0.4.9 allows remote servers to have an unspecified impact via a…
PriorityP343critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
3.48%
87.8th percentile
Stack-based buffer overflow in the url::get_pac function in url.cpp in libproxy 0.4.x before 0.4.9 allows remote servers to have an unspecified impact via a large proxy.pac file.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libproxy | < libproxy 0.3.1-5.1 (bookworm) | libproxy 0.3.1-5.1 (bookworm) |
| debian | libproxy | — | — |
| libproxy_project | libproxy | — | — |
| libproxy_project | libproxy | — | — |
| libproxy_project | libproxy | — | — |
| libproxy_project | libproxy | — | — |
| libproxy_project | libproxy | — | — |
| libproxy_project | libproxy | — | — |
| libproxy_project | libproxy | — | — |
| libproxy_project | libproxy | — | — |
| libproxy_project | libproxy | — | — |
| libproxy_project | libproxy | — | — |
| libproxy_project | libproxy | — | — |
| libproxy_project | libproxy | >= 0 < 0.3.1-5.1 | 0.3.1-5.1 |
| libproxy_project | libproxy | >= 0 < 0.3.1-5.1 | 0.3.1-5.1 |
| libproxy_project | libproxy | >= 0 < 0.3.1-5.1 | 0.3.1-5.1 |
| libproxy_project | libproxy | >= 0 < 0.3.1-5.1 | 0.3.1-5.1 |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv10.0CRITICAL
vendor_debian10.0LOW
vendor_redhat10.0CRITICAL
vendor_ubuntu10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libproxy vulnerabilities
vendor_ubuntu·2012-11-12·CVSS 10.0
CVE-2012-4504 [CRITICAL] libproxy vulnerabilities
Title: libproxy vulnerabilities
Summary: libproxy could be made to crash or run programs if it received specially
crafted network traffic.
Tomas Mraz discovered that libproxy incorrectly handled certain PAC files.
A remote attacker could use this issue to cause libproxy to crash, or to
possibly execute arbitrary code. (CVE-2012-4504, CVE-2012-4505)
Instructions: After a standard system update you need to restart your session to make
all the necessary changes.
Red Hat
libproxy: PAC handling insufficient content length check leading to buffer overflow
vendor_redhat·2012-10-12·CVSS 10.0
CVE-2012-4505 [CRITICAL] libproxy: PAC handling insufficient content length check leading to buffer overflow
libproxy: PAC handling insufficient content length check leading to buffer overflow
Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request, a different vulnerability than CVE-2012-4504.
Red Hat
libproxy: long proxy.pac file handling buffer overflow
vendor_redhat·2012-10-10·CVSS 10.0
CVE-2012-4504 [CRITICAL] libproxy: long proxy.pac file handling buffer overflow
libproxy: long proxy.pac file handling buffer overflow
Stack-based buffer overflow in the url::get_pac function in url.cpp in libproxy 0.4.x before 0.4.9 allows remote servers to have an unspecified impact via a large proxy.pac file.
Statement: Not vulnerable. This issue did not affect the version of libproxy as shipped with Red Hat Enterprise Linux 6.
Package: libproxy (Red Hat Enterprise Linux 6) - Not affected
Debian
CVE-2012-4505: libproxy - Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libprox...
vendor_debian·2012·CVSS 10.0
CVE-2012-4505 [CRITICAL] CVE-2012-4505: libproxy - Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libprox...
Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request, a different vulnerability than CVE-2012-4504.
Scope: local
bookworm: resolved (fixed in 0.3.1-5.1)
bullseye: resolved (fixed in 0.3.1-5.1)
forky: resolved (fixed in 0.3.1-5.1)
sid: resolved (fixed in 0.3.1-5.1)
trixie: resolved (fixed in 0.3.1-5.1)
Debian
CVE-2012-4504: libproxy - Stack-based buffer overflow in the url::get_pac function in url.cpp in libproxy ...
vendor_debian·2012·CVSS 10.0
CVE-2012-4504 [CRITICAL] CVE-2012-4504: libproxy - Stack-based buffer overflow in the url::get_pac function in url.cpp in libproxy ...
Stack-based buffer overflow in the url::get_pac function in url.cpp in libproxy 0.4.x before 0.4.9 allows remote servers to have an unspecified impact via a large proxy.pac file.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-8g7q-m58p-3p6w: Heap-based buffer overflow in the px_pac_reload function in lib/pac
ghsa_unreviewed·2022-05-14·CVSS 10.0
CVE-2012-4505 [CRITICAL] CWE-119 GHSA-8g7q-m58p-3p6w: Heap-based buffer overflow in the px_pac_reload function in lib/pac
Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request, a different vulnerability than CVE-2012-4504.
GHSA
GHSA-c5fx-qjrf-p783: Stack-based buffer overflow in the url::get_pac function in url
ghsa_unreviewed·2022-05-14
CVE-2012-4504 [HIGH] CWE-119 GHSA-c5fx-qjrf-p783: Stack-based buffer overflow in the url::get_pac function in url
Stack-based buffer overflow in the url::get_pac function in url.cpp in libproxy 0.4.x before 0.4.9 allows remote servers to have an unspecified impact via a large proxy.pac file.
OSV
CVE-2012-4505: Heap-based buffer overflow in the px_pac_reload function in lib/pac
osv·2012-11-11·CVSS 10.0
CVE-2012-4505 [CRITICAL] CVE-2012-4505: Heap-based buffer overflow in the px_pac_reload function in lib/pac
Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request, a different vulnerability than CVE-2012-4504.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-4504 libproxy: long proxy.pac file handling buffer overflow [fedora-all]
bugzilla·2012-10-16·CVSS 10.0
CVE-2012-4504 [CRITICAL] CVE-2012-4504 libproxy: long proxy.pac file handling buffer overflow [fedora-all]
CVE-2012-4504 libproxy: long proxy.pac file handling buffer overflow [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue
Bugzilla
CVE-2012-4504 libproxy: long proxy.pac file handling buffer overflow
bugzilla·2012-10-09·CVSS 10.0
CVE-2012-4504 [CRITICAL] CVE-2012-4504 libproxy: long proxy.pac file handling buffer overflow
CVE-2012-4504 libproxy: long proxy.pac file handling buffer overflow
A buffer overflow flaw was discovered in the libproxy's url::get_pac() used to download proxy.pac proxy auto-configuration file. A malicious host hosting proxy.pac, or a man in the middle attacker, could use this flaw to trigger a stack-based buffer overflow in an application using libproxy, if proxy configuration instructed it to download proxy.pac file from a remote HTTP server.
url::get_pac() uses a fixed size buffer buffer[] to store content of the proxy.pac file downloaded from a remote server. When filling the buffer, it uses server-supplied content length value, rather than size buffer, as a limit for the size of the input copied into the buffer. Overflow occurs when server provides sufficiently large file and do
Bugzilla
CVE-2012-4505 libproxy: PAC handling insufficient content length check leading to buffer overflow
bugzilla·2012-10-09·CVSS 10.0
CVE-2012-4505 [CRITICAL] CVE-2012-4505 libproxy: PAC handling insufficient content length check leading to buffer overflow
CVE-2012-4505 libproxy: PAC handling insufficient content length check leading to buffer overflow
An insufficient input validation flaw, leading to a heap-based buffer overflow was found in libproxy 0.3.x in the px_pac_reload() function. libproxy allocates a memory to store downloaded proxy.pac proxy auto-configuration file content using the Content-Length size from the remote server's HTTP response header. Allocation size is content length + 1. A malicious host hosting proxy.pac, or a man in the middle attacker, could use this flaw to make libproxy allocate insufficient amount of memory and subsequently overflow a heap-based buffer.
http://code.google.com/p/libproxy/source/browse/tags/libproxy-0.3.1/src/lib/pac.c#165
165 self->cache = px_malloc0(content_length+1);
166 for (int recvd=0
http://code.google.com/p/libproxy/source/detail?r=853http://lists.opensuse.org/opensuse-updates/2012-10/msg00065.htmlhttp://secunia.com/advisories/51048http://www.openwall.com/lists/oss-security/2012/10/12/1http://www.openwall.com/lists/oss-security/2012/10/12/5http://www.openwall.com/lists/oss-security/2012/10/16/3http://www.securityfocus.com/bid/55909http://www.ubuntu.com/usn/USN-1629-1https://bugzilla.redhat.com/show_bug.cgi?id=864417https://exchange.xforce.ibmcloud.com/vulnerabilities/79249https://groups.google.com/forum/?fromgroups=#%21topic/libproxy/VxZ8No7mT0Ehttp://code.google.com/p/libproxy/source/detail?r=853http://lists.opensuse.org/opensuse-updates/2012-10/msg00065.htmlhttp://secunia.com/advisories/51048http://www.openwall.com/lists/oss-security/2012/10/12/1http://www.openwall.com/lists/oss-security/2012/10/12/5http://www.openwall.com/lists/oss-security/2012/10/16/3http://www.securityfocus.com/bid/55909http://www.ubuntu.com/usn/USN-1629-1https://bugzilla.redhat.com/show_bug.cgi?id=864417https://exchange.xforce.ibmcloud.com/vulnerabilities/79249https://groups.google.com/forum/?fromgroups=#%21topic/libproxy/VxZ8No7mT0E
2012-11-11
Published