Title: STunnel Client Negotiation Protocol Format String Vulnerability
Severity: CRITICAL
Description:
Stunnel is a freely available, open source cryptography wrapper. It is designed to wrap arbitrary protocols that may or may not support cryptography. It is maintained by the Stunnel project.
A problem with Stunnel could make it possible for remote users to gain administrative access. The problem is in the handling of protocol negotiations by the software.
Stunnel can be used to wrap plaintext services, such as pop3 or smtp. This make it possible to secure services and prevent the flow of plaintext information such as passwords or other data. The software package provides functions that work with these services to interact with the specific means of launching cryptographic connections.
Stunnel does not properly handle unexpected input by users. When a protocol is initiated between a client and the server, it is possible to supply a format string to the Stunnel server that may result in the execution of arbitrary code.
This makes it possible for remote users to execute arbitrary code as root, and could potentially result in a remote user gaining administrative access on a vulnerable system.
Affected Products:
- MandrakeSoft Linux Mandrake 8.1.0
- MandrakeSoft Linux Mandrake 8.1.0 ia64
- RedHat Linux 7.2.0 i386
- RedHat Linux 7.2.0 ia64
- Stunnel Stunnel 0.0.03.20
- Stunnel Stunnel 3.15.0
- Stunnel Stunnel 3.16.0
- Stunnel Stunnel 3.17.0
- Stunnel Stunnel 3.18.0
- Stunnel Stunnel 3.19.0
- Stunnel Stunnel 3.21.0
- Stunnel Stunnel 3.21.0a
- Stunnel Stunnel 3.21.0b
- Stunnel Stunnel 3.21.0c
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
