Vulnerability CVE-2013-1762
Published: 2013-03-08

Description:
stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow.

Type:

CWE-94

 (Improper Control of Generation of Code ('Code Injection'))

CVSS2 => (AV:N/AC:H/Au:N/C:P/I:P/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.6/10
8.5/10
4.9/10
Exploit range
Attack complexity
Authentication
Remote
High
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Complete
Affected software
Stunnel -> Stunnel 

 References:
https://www.stunnel.org/CVE-2013-1762.html
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0097
http://www.mandriva.com/security/advisories?name=MDVSA-2013:130
http://www.debian.org/security/2013/dsa-2664
http://rhn.redhat.com/errata/RHSA-2013-0714.html
Copyright 2024, cxsecurity.com

 

Back to Top