Input validation error in socat - CVE-2015-1379

Vulnerability identifier: #VU33085

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-1379

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash).

socat
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
socat (Alpine package)
socat-debuginfo
socat-debugsource
socat

Install update from vendor's website.

socat - update to 1.7.3.0
socat (Alpine package) - update to 1.7.3.0-r0
socat-debuginfo - update to 1.7.2.4-4.6.1
socat-debugsource - update to 1.7.2.4-4.6.1
socat - update to 1.7.2.4-4.6.1

• http://www.dest-unreach.org/socat/
• http://www.openwall.com/lists/oss-security/2015/01/27/19
• http://www.openwall.com/lists/oss-security/2015/04/06/4
• http://www.securityfocus.com/bid/72321
• https://bugzilla.redhat.com/show_bug.cgi?id=1185711

• Input validation error in www.dest-unreach socat
• Input validation error in socat (Alpine package)
• SUSE update for socat