CVE-2012-4505
published 2012-11-11CVE-2012-4505: Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a…
PriorityP344critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
3.22%
86.8th percentile
Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request, a different vulnerability than CVE-2012-4504.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libproxy | < libproxy 0.3.1-5.1 (bookworm) | libproxy 0.3.1-5.1 (bookworm) |
| libproxy_project | libproxy | — | — |
| libproxy_project | libproxy | — | — |
| libproxy_project | libproxy | — | — |
| libproxy_project | libproxy | >= 0 < 0.3.1-5.1 | 0.3.1-5.1 |
| libproxy_project | libproxy | >= 0 < 0.3.1-5.1 | 0.3.1-5.1 |
| libproxy_project | libproxy | >= 0 < 0.3.1-5.1 | 0.3.1-5.1 |
| libproxy_project | libproxy | >= 0 < 0.3.1-5.1 | 0.3.1-5.1 |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv10.0CRITICAL
vendor_debian10.0CRITICAL
vendor_redhat10.0CRITICAL
vendor_ubuntu10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libproxy vulnerabilities
vendor_ubuntu·2012-11-12·CVSS 10.0
CVE-2012-4504 [CRITICAL] libproxy vulnerabilities
Title: libproxy vulnerabilities
Summary: libproxy could be made to crash or run programs if it received specially
crafted network traffic.
Tomas Mraz discovered that libproxy incorrectly handled certain PAC files.
A remote attacker could use this issue to cause libproxy to crash, or to
possibly execute arbitrary code. (CVE-2012-4504, CVE-2012-4505)
Instructions: After a standard system update you need to restart your session to make
all the necessary changes.
Red Hat
libproxy: PAC handling insufficient content length check leading to buffer overflow
vendor_redhat·2012-10-12·CVSS 10.0
CVE-2012-4505 [CRITICAL] libproxy: PAC handling insufficient content length check leading to buffer overflow
libproxy: PAC handling insufficient content length check leading to buffer overflow
Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request, a different vulnerability than CVE-2012-4504.
Debian
CVE-2012-4505: libproxy - Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libprox...
vendor_debian·2012·CVSS 10.0
CVE-2012-4505 [CRITICAL] CVE-2012-4505: libproxy - Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libprox...
Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request, a different vulnerability than CVE-2012-4504.
Scope: local
bookworm: resolved (fixed in 0.3.1-5.1)
bullseye: resolved (fixed in 0.3.1-5.1)
forky: resolved (fixed in 0.3.1-5.1)
sid: resolved (fixed in 0.3.1-5.1)
trixie: resolved (fixed in 0.3.1-5.1)
GHSA
GHSA-8g7q-m58p-3p6w: Heap-based buffer overflow in the px_pac_reload function in lib/pac
ghsa_unreviewed·2022-05-14·CVSS 10.0
CVE-2012-4505 [CRITICAL] CWE-119 GHSA-8g7q-m58p-3p6w: Heap-based buffer overflow in the px_pac_reload function in lib/pac
Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request, a different vulnerability than CVE-2012-4504.
OSV
CVE-2012-4505: Heap-based buffer overflow in the px_pac_reload function in lib/pac
osv·2012-11-11·CVSS 10.0
CVE-2012-4505 [CRITICAL] CVE-2012-4505: Heap-based buffer overflow in the px_pac_reload function in lib/pac
Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request, a different vulnerability than CVE-2012-4504.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-4504 libproxy: long proxy.pac file handling buffer overflow
bugzilla·2012-10-09·CVSS 10.0
CVE-2012-4504 [CRITICAL] CVE-2012-4504 libproxy: long proxy.pac file handling buffer overflow
CVE-2012-4504 libproxy: long proxy.pac file handling buffer overflow
A buffer overflow flaw was discovered in the libproxy's url::get_pac() used to download proxy.pac proxy auto-configuration file. A malicious host hosting proxy.pac, or a man in the middle attacker, could use this flaw to trigger a stack-based buffer overflow in an application using libproxy, if proxy configuration instructed it to download proxy.pac file from a remote HTTP server.
url::get_pac() uses a fixed size buffer buffer[] to store content of the proxy.pac file downloaded from a remote server. When filling the buffer, it uses server-supplied content length value, rather than size buffer, as a limit for the size of the input copied into the buffer. Overflow occurs when server provides sufficiently large file and do
Bugzilla
CVE-2012-4505 libproxy: PAC handling insufficient content length check leading to buffer overflow
bugzilla·2012-10-09·CVSS 10.0
CVE-2012-4505 [CRITICAL] CVE-2012-4505 libproxy: PAC handling insufficient content length check leading to buffer overflow
CVE-2012-4505 libproxy: PAC handling insufficient content length check leading to buffer overflow
An insufficient input validation flaw, leading to a heap-based buffer overflow was found in libproxy 0.3.x in the px_pac_reload() function. libproxy allocates a memory to store downloaded proxy.pac proxy auto-configuration file content using the Content-Length size from the remote server's HTTP response header. Allocation size is content length + 1. A malicious host hosting proxy.pac, or a man in the middle attacker, could use this flaw to make libproxy allocate insufficient amount of memory and subsequently overflow a heap-based buffer.
http://code.google.com/p/libproxy/source/browse/tags/libproxy-0.3.1/src/lib/pac.c#165
165 self->cache = px_malloc0(content_length+1);
166 for (int recvd=0
http://lists.opensuse.org/opensuse-updates/2012-10/msg00065.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1461.htmlhttp://secunia.com/advisories/51048http://secunia.com/advisories/51180http://secunia.com/advisories/51308http://www.debian.org/security/2012/dsa-2571http://www.openwall.com/lists/oss-security/2012/10/12/1http://www.openwall.com/lists/oss-security/2012/10/12/5http://www.openwall.com/lists/oss-security/2012/10/16/3http://www.securityfocus.com/bid/55910http://www.ubuntu.com/usn/USN-1629-1https://bugzilla.redhat.com/show_bug.cgi?id=864612https://groups.google.com/forum/?fromgroups=#%21topic/libproxy/VxZ8No7mT0Ehttp://lists.opensuse.org/opensuse-updates/2012-10/msg00065.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1461.htmlhttp://secunia.com/advisories/51048http://secunia.com/advisories/51180http://secunia.com/advisories/51308http://www.debian.org/security/2012/dsa-2571http://www.openwall.com/lists/oss-security/2012/10/12/1http://www.openwall.com/lists/oss-security/2012/10/12/5http://www.openwall.com/lists/oss-security/2012/10/16/3http://www.securityfocus.com/bid/55910http://www.ubuntu.com/usn/USN-1629-1https://bugzilla.redhat.com/show_bug.cgi?id=864612https://groups.google.com/forum/?fromgroups=#%21topic/libproxy/VxZ8No7mT0E
2012-11-11
Published