CVE-2017-2885
published 2018-04-24CVE-2017-2885: An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow…
PriorityP269critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
24.34%
97.6th percentile
An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libsoup2.4 | < libsoup2.4 2.56.1-1 (bookworm) | libsoup2.4 2.56.1-1 (bookworm) |
| gnome | libsoup | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_workstation | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability resides in the `soup_filter_input_stream_read_until()` function during parsing of chunk-encoded HTTP traffic. Monitor or instrument this function for anomalous boundary conditions. ↗
- →The attack vector is HTTP Chunked Encoding. Inspect HTTP traffic for malformed or oversized chunked-encoding headers/bodies targeting applications using libsoup as either an HTTP server or client. ↗
- →Both server-side (receiving specially crafted HTTP requests) and client-side (connecting to a malicious HTTP server) libsoup usage are exploitable attack surfaces. Detection should cover both inbound and outbound HTTP chunked-encoding traffic. ↗
- ·libsoup packages shipped with Red Hat Enterprise Linux 7 are compiled with stack smashing protection (SSP), which significantly hardens exploitation — most attempts will result in a crash rather than RCE, though RCE cannot be fully ruled out. ↗
- ·libsoup packages on Red Hat Enterprise Linux 5 and 6 are NOT affected by this CVE. ↗
- ·The vulnerability is fixed in libsoup version 2.56.1-1 (Debian) and the upstream patch commit is 03c91c76daf70ee227f38304c5e45a155f45073d. Systems running libsoup 2.58 without this patch are vulnerable. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libsoup: Stack based buffer overflow with HTTP Chunked Encoding
vendor_redhat·2017-08-10·CVSS 9.8
CVE-2017-2885 [CRITICAL] CWE-121 libsoup: Stack based buffer overflow with HTTP Chunked Encoding
libsoup: Stack based buffer overflow with HTTP Chunked Encoding
An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.
A stack-based buffer overflow flaw was discovered within the HTTP processing of libsoup. A remote attacker could exploit this flaw to cause a crash or, potentially, execute arbitrary code by sending a specially crafted HTTP request to a server using the libsoup HTTP server functionality or by tricking a user into connecting to a malicious HTTP server with an application using the libsoup HTTP client functionality.
Statement: This issue affect
Ubuntu
libsoup vulnerability
vendor_ubuntu·2017-08-10
CVE-2017-2885 libsoup vulnerability
Title: libsoup vulnerability
Summary: Applications using libsoup could be made to crash or run programs
as your login if it received specially crafted network traffic.
Aleksandar Nikolic discovered a stack based buffer overflow when
handling chunked encoding. An attacker could use this to cause a
denial of service or possibly execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2017-2885: libsoup2.4 - An exploitable stack based buffer overflow vulnerability exists in the GNOME lib...
vendor_debian·2017·CVSS 9.8
CVE-2017-2885 [CRITICAL] CVE-2017-2885: libsoup2.4 - An exploitable stack based buffer overflow vulnerability exists in the GNOME lib...
An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.
Scope: local
bookworm: resolved (fixed in 2.56.1-1)
bullseye: resolved (fixed in 2.56.1-1)
trixie: resolved (fixed in 2.56.1-1)
GHSA
GHSA-qq4w-8g63-5r25: An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2
ghsa_unreviewed·2022-05-13
CVE-2017-2885 [CRITICAL] CWE-119 GHSA-qq4w-8g63-5r25: An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2
An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.
OSV
CVE-2017-2885: An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2
osv·2018-04-24·CVSS 9.8
CVE-2017-2885 [CRITICAL] CVE-2017-2885: An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2
An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-2885 mingw-libsoup: libsoup: Stack based buffer overflow with HTTP Chunked Encoding [epel-7]
bugzilla·2017-08-10·CVSS 9.8
CVE-2017-2885 [CRITICAL] CVE-2017-2885 mingw-libsoup: libsoup: Stack based buffer overflow with HTTP Chunked Encoding [epel-7]
CVE-2017-2885 mingw-libsoup: libsoup: Stack based buffer overflow with HTTP Chunked Encoding [epel-7]
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug. This will ensure that all associated bugs get updated
when new packages are pushed to stable.
# bugfix, security, enhancement, newpackage (required)
type=security
# testing, stable
request=testing
# Bug numbers: 1234,9876
bugs=1479281
# Description of your update
notes=Security fix for [PUT CVEs HERE]
# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3
# Automatically close bugs when this marked as stable
close_bugs=True
# Suggest that users res
Bugzilla
CVE-2017-2885 libsoup: Stack based buffer overflow with HTTP Chunked Encoding [fedora-all]
bugzilla·2017-08-10·CVSS 9.8
CVE-2017-2885 [CRITICAL] CVE-2017-2885 libsoup: Stack based buffer overflow with HTTP Chunked Encoding [fedora-all]
CVE-2017-2885 libsoup: Stack based buffer overflow with HTTP Chunked Encoding [fedora-all]
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug. This will ensure that all associated bugs get updated
when new packages are pushed to stable.
# bugfix, security, enhancement, newpackage (required)
type=security
# testing, stable
request=testing
# Bug numbers: 1234,9876
bugs=1479281
# Description of your update
notes=Security fix for [PUT CVEs HERE]
# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3
# Automatically close bugs when this marked as stable
close_bugs=True
# Suggest that users restart after
Bugzilla
CVE-2017-2885 mingw-libsoup: libsoup: Stack based buffer overflow with HTTP Chunked Encoding [fedora-all]
bugzilla·2017-08-10·CVSS 9.8
CVE-2017-2885 [CRITICAL] CVE-2017-2885 mingw-libsoup: libsoup: Stack based buffer overflow with HTTP Chunked Encoding [fedora-all]
CVE-2017-2885 mingw-libsoup: libsoup: Stack based buffer overflow with HTTP Chunked Encoding [fedora-all]
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug. This will ensure that all associated bugs get updated
when new packages are pushed to stable.
# bugfix, security, enhancement, newpackage (required)
type=security
# testing, stable
request=testing
# Bug numbers: 1234,9876
bugs=1479281
# Description of your update
notes=Security fix for [PUT CVEs HERE]
# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3
# Automatically close bugs when this marked as stable
close_bugs=True
# Suggest that users
Bugzilla
CVE-2017-2885 libsoup: Stack based buffer overflow with HTTP Chunked Encoding
bugzilla·2017-08-08·CVSS 9.8
CVE-2017-2885 [CRITICAL] CVE-2017-2885 libsoup: Stack based buffer overflow with HTTP Chunked Encoding
CVE-2017-2885 libsoup: Stack based buffer overflow with HTTP Chunked Encoding
A stack based buffer overflow vulnerability has been reported in GNOME libsoup 2.58. The flaw is caused due to a boundary error within the "soup_filter_input_stream_read_until()" function when parsing chunk encoded HTTP traffic and affects both the server and client functionality of libsoup.
A remote attacker could exploit this flaw to cause a crash or, potentially, execute arbitrary code by sending a specially crafted HTTP request to a server using the libsoup HTTP server functionality or by tricking a user into connecting to a malicious HTTP server with an application using the libsoup HTTP client functionality.
Please note that the libsoup packages as shipped with Red Hat Enterprise Linux 7 contain a "stack
http://packetstormsecurity.com/files/160388/ProCaster-LE-32F430-GStreamer-souphttpsrc-libsoup-2.51.3-Stack-Overflow.htmlhttp://seclists.org/fulldisclosure/2020/Dec/3http://www.securityfocus.com/bid/100258https://access.redhat.com/errata/RHSA-2017:2459https://www.debian.org/security/2017/dsa-3929https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0392http://packetstormsecurity.com/files/160388/ProCaster-LE-32F430-GStreamer-souphttpsrc-libsoup-2.51.3-Stack-Overflow.htmlhttp://seclists.org/fulldisclosure/2020/Dec/3http://www.securityfocus.com/bid/100258https://access.redhat.com/errata/RHSA-2017:2459https://www.debian.org/security/2017/dsa-3929https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0392
2018-04-24
Published