CVE-2013-1762 Integer overflow in n/a
Remote attackers can execute arbitrary code via crafted requests if CONNECT protocol and NTLM authentication are enabled in stunnel.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-1762?
CVE-2013-1762 is a medium-severity vulnerability in n/a, published on 8 Mar 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow.
Weakness: CWE-94
Which versions are affected by CVE-2013-1762?
It affects 1 product.
Linux distribution packages (8)
stunnel Red Hat:enterprise_linux:6::client | All versions | 0:4.29-3.el6_4 |
stunnel-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:4.29-3.el6_4 |
stunnel Red Hat:enterprise_linux:6::computenode | All versions | 0:4.29-3.el6_4 |
stunnel-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:4.29-3.el6_4 |
stunnel Red Hat:enterprise_linux:6::server | All versions | 0:4.29-3.el6_4 |
stunnel-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:4.29-3.el6_4 |
stunnel Red Hat:enterprise_linux:6::workstation | All versions | 0:4.29-3.el6_4 |
stunnel-debuginfo Red Hat:enterprise_linux:6::workstation | All versions | 0:4.29-3.el6_4 |
Products include Stunnel Stunnel.
How do I fix CVE-2013-1762?
Upgrade to a fixed version.
Is CVE-2013-1762 being exploited?
There is no known exploitation of CVE-2013-1762 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2001-0060 Other in n/a
- CVE-2011-2940 Memory corruption in n/a
- CVE-2021-20230 Auth bypass in stunnel
- CVE-2008-2400 Unspecified vulnerability in stunnel before 4.23, when running as a service on Windows, allows local users to gain privileges via unknown attack vectors.
- CVE-2008-2420 Security feature bypass in n/a
Sources
Also known as DEBIAN-CVE-2013-1762, DSA-2664-1, GHSA-997q-cp6v-cm6w, RHSA-2013:0714.