3proxy: Denial of service — GLSA 200711-13

A vulnerability has been discovered in 3proxy, possibly resulting in a Denial of Service.

Affected packages

Background

3proxy is a really tiny cross-platform proxy servers set, including HTTP, HTTPS, FTP, SOCKS and POP3 support.

Description

3proxy contains a double free vulnerability in the ftpprchild() function, which frees param->hostname and calls the parsehostname() function, which in turn attempts to free param->hostname again.

Impact

A remote attacker could send a specially crafted request to the proxy, possibly resulting in a Denial of Service. Under typical configuration, the scope of this vulnerability is limited to the local network.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-proxy/3proxy-0.5.3j"

References

• CVE-2007-5622

Release date
November 08, 2007

Latest revision
November 08, 2007: 01

Severity
normal

Exploitable
remote

Bugzilla entries

• 196772