ID CVE-2013-1762
Summary stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow.
References
Vulnerable Configurations
  • Stunnel 4.40
    cpe:2.3:a:stunnel:stunnel:4.40
  • Stunnel 4.28
    cpe:2.3:a:stunnel:stunnel:4.28
  • Stunnel 4.27
    cpe:2.3:a:stunnel:stunnel:4.27
  • Stunnel 4.26
    cpe:2.3:a:stunnel:stunnel:4.26
  • Stunnel 4.25
    cpe:2.3:a:stunnel:stunnel:4.25
  • Stunnel 4.24
    cpe:2.3:a:stunnel:stunnel:4.24
  • Stunnel 4.23
    cpe:2.3:a:stunnel:stunnel:4.23
  • Stunnel 4.22
    cpe:2.3:a:stunnel:stunnel:4.22
  • Stunnel 4.21
    cpe:2.3:a:stunnel:stunnel:4.21
  • Stunnel 4.29
    cpe:2.3:a:stunnel:stunnel:4.29
  • Stunnel 4.30
    cpe:2.3:a:stunnel:stunnel:4.30
  • Stunnel 4.31
    cpe:2.3:a:stunnel:stunnel:4.31
  • Stunnel 4.32
    cpe:2.3:a:stunnel:stunnel:4.32
  • Stunnel 4.33
    cpe:2.3:a:stunnel:stunnel:4.33
  • Stunnel 4.34
    cpe:2.3:a:stunnel:stunnel:4.34
  • Stunnel 4.35
    cpe:2.3:a:stunnel:stunnel:4.35
  • Stunnel 4.36
    cpe:2.3:a:stunnel:stunnel:4.36
  • Stunnel 4.37
    cpe:2.3:a:stunnel:stunnel:4.37
  • Stunnel 4.38
    cpe:2.3:a:stunnel:stunnel:4.38
  • Stunnel 4.39
    cpe:2.3:a:stunnel:stunnel:4.39
  • Stunnel 4.41
    cpe:2.3:a:stunnel:stunnel:4.41
  • Stunnel 4.42
    cpe:2.3:a:stunnel:stunnel:4.42
  • Stunnel 4.43
    cpe:2.3:a:stunnel:stunnel:4.43
  • Stunnel 4.44
    cpe:2.3:a:stunnel:stunnel:4.44
  • Stunnel 4.45
    cpe:2.3:a:stunnel:stunnel:4.45
  • Stunnel 4.46
    cpe:2.3:a:stunnel:stunnel:4.46
  • Stunnel 4.47
    cpe:2.3:a:stunnel:stunnel:4.47
  • Stunnel 4.48
    cpe:2.3:a:stunnel:stunnel:4.48
  • Stunnel 4.49
    cpe:2.3:a:stunnel:stunnel:4.49
  • Stunnel 4.50
    cpe:2.3:a:stunnel:stunnel:4.50
  • Stunnel 4.51
    cpe:2.3:a:stunnel:stunnel:4.51
  • Stunnel 4.52
    cpe:2.3:a:stunnel:stunnel:4.52
  • Stunnel 4.53
    cpe:2.3:a:stunnel:stunnel:4.53
  • Stunnel 4.54
    cpe:2.3:a:stunnel:stunnel:4.54
CVSS
Base: 6.6 (as of 18-03-2013 - 09:47)
Impact:
Exploitability:
CWE CWE-94
CAPEC
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Manipulating User-Controlled Variables
    This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
Access
VectorComplexityAuthentication
NETWORK HIGH NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL COMPLETE
nessus via4
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2013-0714.NASL
    description From Red Hat Security Advisory 2013:0714 : An updated stunnel package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. stunnel is a socket wrapper which can provide SSL (Secure Sockets Layer) support to ordinary applications. For example, it can be used in conjunction with imapd to create an SSL-secure IMAP server. An integer conversion issue was found in stunnel when using Microsoft NT LAN Manager (NTLM) authentication with the HTTP CONNECT tunneling method. With this configuration, and using stunnel in SSL client mode on a 64-bit system, an attacker could possibly execute arbitrary code with the privileges of the stunnel process via a man-in-the-middle attack or by tricking a user into using a malicious proxy. (CVE-2013-1762) All stunnel users should upgrade to this updated package, which contains a backported patch to correct this issue.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 68803
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68803
    title Oracle Linux 6 : stunnel (ELSA-2013-0714)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2013-0714.NASL
    description An updated stunnel package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. stunnel is a socket wrapper which can provide SSL (Secure Sockets Layer) support to ordinary applications. For example, it can be used in conjunction with imapd to create an SSL-secure IMAP server. An integer conversion issue was found in stunnel when using Microsoft NT LAN Manager (NTLM) authentication with the HTTP CONNECT tunneling method. With this configuration, and using stunnel in SSL client mode on a 64-bit system, an attacker could possibly execute arbitrary code with the privileges of the stunnel process via a man-in-the-middle attack or by tricking a user into using a malicious proxy. (CVE-2013-1762) All stunnel users should upgrade to this updated package, which contains a backported patch to correct this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 65903
    published 2013-04-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65903
    title CentOS 6 : stunnel (CESA-2013:0714)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20130408_STUNNEL_ON_SL6_X.NASL
    description An integer conversion issue was found in stunnel when using Microsoft NT LAN Manager (NTLM) authentication with the HTTP CONNECT tunneling method. With this configuration, and using stunnel in SSL client mode on a 64-bit system, an attacker could possibly execute arbitrary code with the privileges of the stunnel process via a man-in-the-middle attack or by tricking a user into using a malicious proxy. (CVE-2013-1762)
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 65864
    published 2013-04-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65864
    title Scientific Linux Security Update : stunnel on SL6.x i386/x86_64
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2013-0714.NASL
    description An updated stunnel package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. stunnel is a socket wrapper which can provide SSL (Secure Sockets Layer) support to ordinary applications. For example, it can be used in conjunction with imapd to create an SSL-secure IMAP server. An integer conversion issue was found in stunnel when using Microsoft NT LAN Manager (NTLM) authentication with the HTTP CONNECT tunneling method. With this configuration, and using stunnel in SSL client mode on a 64-bit system, an attacker could possibly execute arbitrary code with the privileges of the stunnel process via a man-in-the-middle attack or by tricking a user into using a malicious proxy. (CVE-2013-1762) All stunnel users should upgrade to this updated package, which contains a backported patch to correct this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 65863
    published 2013-04-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65863
    title RHEL 6 : stunnel (RHSA-2013:0714)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_STUNNEL-130305.NASL
    description This update for stunnel fixes a buffer overflow vulnerability caused by incorrect integer conversion in the NTLM authentication of the CONNECT protocol negotiation. (CVE-2013-1762)
    last seen 2019-02-21
    modified 2014-04-20
    plugin id 66195
    published 2013-04-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66195
    title SuSE 11.2 Security Update : stunnel (SAT Patch Number 7449)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2664.NASL
    description Stunnel, a program designed to work as an universal SSL tunnel for network daemons, is prone to a buffer overflow vulnerability when using the Microsoft NT LAN Manager (NTLM) authentication ('protocolAuthentication = NTLM') together with the 'connect'protocol method ('protocol = connect'). With these prerequisites and using stunnel4 in SSL client mode ('client = yes') on a 64 bit host, an attacker could possibly execute arbitrary code with the privileges of the stunnel process, if the attacker can either control the specified proxy server or perform man-in-the-middle attacks on the tcp session between stunnel and the proxy sever. Note that for the testing distribution (wheezy) and the unstable distribution (sid), stunnel4 is compiled with stack smashing protection enabled, which should help protect against arbitrary code execution.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 66296
    published 2013-05-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66296
    title Debian DSA-2664-1 : stunnel4 - buffer overflow
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2013-130.NASL
    description Updated stunnel packages fix security vulnerability : stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow (CVE-2013-1762). The updated packages also fixes the following : - move library subpackages back into main stunnel package - add a systemd unit file (partially fixing Bug 3951) - fix issues with stunnel.conf and stunnel.pem, with stunnel running in a chroot environment.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 66142
    published 2013-04-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66142
    title Mandriva Linux Security Advisory : stunnel (MDVSA-2013:130)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201402-08.NASL
    description The remote host is affected by the vulnerability described in GLSA-201402-08 (stunnel: Arbitrary code execution) A buffer overflow vulnerability has been discovered in stunnel. Please review the CVE identifier referenced below for details. Impact : A remote attacker could entice a user to connect to a malicious proxy server, resulting in the execution of arbitrary code within the configured chroot directory, with the privileges of the user running stunnel. Please review the references below for details. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 72385
    published 2014-02-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=72385
    title GLSA-201402-08 : stunnel: Arbitrary code execution
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_C97219B6843D11E2B131000C299B62E1.NASL
    description Michal Trojnara reports : 64-bit versions of stunnel with the following conditions : * NTLM authentication enabled * CONNECT protocol negotiation enabled * Configured in SSL client mode * An attacker that can either control the proxy server specified in the 'connect' option or execute MITM attacks on the TCP session between stunnel and the proxy Can be exploited for remote code execution. The code is executed within the configured chroot directory, with privileges of the configured user and group.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 65003
    published 2013-03-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65003
    title FreeBSD : stunnel -- Remote Code Execution (c97219b6-843d-11e2-b131-000c299b62e1)
  • NASL family Windows
    NASL id STUNNEL_4_55.NASL
    description The version of stunnel installed on the remote host is a version after 4.21 and prior to 4.55. It is, therefore, affected by the following vulnerabilities : - The bundled version of OpenSSL contains an error related to CBC-mode and timing that allows an attacker to recover plaintext from encrypted communications. (CVE-2013-0169) - A buffer overflow condition exists related to NTLM authentication. Note this issue does not affect 32-bit builds.(CVE-2013-1762)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 65690
    published 2013-03-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65690
    title stunnel 4.21 - 4.54 Multiple Vulnerabilities
redhat via4
advisories
bugzilla
id 917839
title CVE-2013-1762 Stunnel: buffer overflow vulnerability due to incorrect integer conversion in the NTLM authentication of the CONNECT protocol negotiation
oval
AND
  • comment stunnel is earlier than 0:4.29-3.el6_4
    oval oval:com.redhat.rhsa:tst:20130714005
  • comment stunnel is signed with Red Hat redhatrelease2 key
    oval oval:com.redhat.rhsa:tst:20130714006
  • OR
    • comment Red Hat Enterprise Linux 6 Client is installed
      oval oval:com.redhat.rhba:tst:20111656001
    • comment Red Hat Enterprise Linux 6 Server is installed
      oval oval:com.redhat.rhba:tst:20111656002
    • comment Red Hat Enterprise Linux 6 Workstation is installed
      oval oval:com.redhat.rhba:tst:20111656003
    • comment Red Hat Enterprise Linux 6 ComputeNode is installed
      oval oval:com.redhat.rhba:tst:20111656004
rhsa
id RHSA-2013:0714
released 2013-04-08
severity Moderate
title RHSA-2013:0714: stunnel security update (Moderate)
rpms stunnel-0:4.29-3.el6_4
refmap via4
confirm
debian DSA-2664
mandriva MDVSA-2013:130
Last major update 17-01-2014 - 00:13
Published 08-03-2013 - 13:55
Back to Top