CVE-2023-25076 (published 2023-03-30T15:15Z)

A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80df9b7b345cc9eba55df74a07b498819ba). A specially crafted HTTP or TLS packet can lead to arbitrary code execution. An attacker could send a malicious packet to trigger this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/dlundquist/sniproxy
commit_details: repo_url: https://github.com/dlundquist/sniproxy
author: Dustin Lundquist
author_date: 2023-03-16 20:42:20-07:00
msg: address: fix buffer overflow

Update tests to work on Debian 11.
repository: repo_url: https://github.com/dlundquist/sniproxy
repo_name: dlundquist/sniproxy
description: Proxies incoming HTTP and TLS connections based on the hostname contained in the initial request of the TCP session.
repo_language: C
owner: dlundquist
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,9 @@
+2023-03-16  Dustin Lundquist <dustin@null-ptr.net>
+	0.6.1 Release
+
+	* Fix buffer overflow in address module
+	* Fix tests
+
 2018-12-05  Dustin Lundquist <dustin@null-ptr.net>
 	0.6.0 Release
 

programming_language: Markdown
filename: configure.ac
change_type: ModificationType.MODIFY
diff: @@ -2,7 +2,7 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.60])
-AC_INIT([sniproxy], [0.6.0])
+AC_INIT([sniproxy], [0.6.1])
 AC_CONFIG_SRCDIR([src/sniproxy.c])
 AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([subdir-objects])

programming_language: Objective-C
filename: changelog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,10 @@
+sniproxy (0.6.1) unstable; urgency=high
+
+  * Fix buffer overflow in address module
+  * Fix tests
+
+ -- Dustin Lundquist <dustin@null-ptr.net>  Thu, 16 Mar 2023 21:53:48 -0700
+
 sniproxy (0.6.0) unstable; urgency=medium
 
   * PROXY v1 protocol support
@@ -10,7 +17,7 @@ sniproxy (0.6.0) unstable; urgency=medium
 sniproxy (0.5.0) unstable; urgency=medium
 
   * Transparent proxy support
-  * Use accept4() on Linix
+  * Use accept4() on Linux
   * Run as group specified in config
 
  -- Dustin Lundquist <dustin@null-ptr.net>  Wed, 26 Apr 2017 07:17:13 -0700

programming_language: Markdown
filename: compat
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-8
+10

programming_language: SQL
filename: sniproxy.spec
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 Name: sniproxy
-Version: 0.6.0
+Version: 0.6.1
 Release: 1%{?dist}
 Summary: Transparent TLS and HTTP layer 4 proxy with SNI support
 
@@ -46,6 +46,10 @@ rm -rf $RPM_BUILD_ROOT
 
 
 %changelog
+* Thu Mar 16 2023 Dustin Lundquist <dustin@null-ptr.net 0.6.1-1
+- Fix buffer overflow in address module
+- Fix tests
+
 * Wed Dec 5 2018 Dustin Lundquist <dustin@null-ptr.net> 0.6.0-1
 - PROXY v1 protocol support
 - SO_REUSEPORT support on Linux 3.9 and later

programming_language: Markdown
filename: setver.sh
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 #!/bin/sh
 
-VERSION=0.6.0
+VERSION=0.6.1
 
 SOURCE_DIR=$(dirname $0)
 GIT_DIR=${SOURCE_DIR}/.git

programming_language: Shell
filename: address.c
change_type: ModificationType.MODIFY
diff: @@ -148,6 +148,8 @@ new_address(const char *hostname_or_ip) {
     if (hostname_or_ip[0] == '[' &&
             (port = strchr(hostname_or_ip, ']')) != NULL) {
         len = (size_t)(port - hostname_or_ip - 1);
+        if (len >= INET6_ADDRSTRLEN)
+            return NULL;
 
         /* inet_pton() will not parse the IP correctly unless it is in a
          * separate string.

programming_language: C
filename: Makefile.am
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,8 @@
 AM_CPPFLAGS = -I$(top_srcdir)/src -g $(LIBEV_CFLAGS) $(LIBPCRE_CFLAGS) $(LIBUDNS_CFLAGS)
 AM_CFLAGS = -fno-strict-aliasing -Wall -Wextra -Wpedantic -Wwrite-strings
 
+.NOTPARALLEL:
+
 TESTS = address_test \
         buffer_test \
         cfg_tokenizer_test \

programming_language: Shell
filename: bad_dns_request_test
change_type: ModificationType.MODIFY
diff: @@ -35,6 +35,11 @@ my $bad_requests = [
         request => "GET / HTTP/1.1\r\nHost: \0example.com\r\n\r\n",
         client => \&http_client,
     },
+    {
+        # Exceed hostname buffer size
+        request => "GET / HTTP/1.1\r\nHost: [" . 'long.' x 60 . "example.com]\r\n\r\n",
+        client => \&http_client,
+    },
     {
         # Test client aborting connection before DNS response received
         request => "GET / HTTP/1.1\r\nHost: example.com\r\n\r\n",

programming_language: Perl
filename: slow_client_test
change_type: ModificationType.MODIFY
diff: @@ -31,11 +31,16 @@ sub slow_client($$) {
     my $socket = IO::Socket::INET->new(PeerAddr => '127.0.0.1',
             PeerPort => $port,
             Proto => "tcp",
-            Type => SOCK_STREAM)
+            Type => SOCK_STREAM,
+            Timeout => 5)
         or die "couldn't connect $!";
 
     $socket->send($request);
     foreach (split("\r\n", $request)) {
+        unless ($socket->connected()) {
+            print "Disconnected\n";
+            exit(0);
+        }
         $socket->send("$_\r\n");
         sleep(1);
     }

programming_language: Perl