Bugzilla – Bug 821985
VUL-1: CVE-2013-3571: socat: fd leak in server mode
Last modified: 2016-10-20 10:24:14 UTC
is public, via socat release 1.7.2.2 This release fixes a security issue: Under certain circumstances, an FD leak occurs and may be misused for denial-of-service attacks against socat running in server mode (CVE-2013-3571)
bugbot adjusting priority
The issue is fixed in commit 022f0a46e63a05f973013ae2d4947e8e7a078154 in git://repo.or.cz/socat.git. The commit also adds a test.sh script that might be useful for testing.
Reproducing & testing the bug is quite easy, actually. These are the instructions from the CVE advisory: In one terminal run the server: socat -d tcp-listen:10000,reuseaddr,fork,range=0.0.0.0/32 pipe In a second terminal see which FDs are open, then connect (implicitely using a forbidden address), and check if there is a new FD open, e.g.: lsof -p $(pgrep socat) socat /dev/null tcp:localhost:10000 lsof -p $(pgrep socat) If the second lsof shows an additional FD as in the following line, this socat version is vulnerable: socat 17947 gerhard 4u sock 0,6 0t0 1145265 can't identify protocol
Created attachment 664419 [details] Fixes CVE-2013-3571 Minimal change extracted from upstream commit 022f0a46e63a05f973013ae2d4947e8e7a078154.
SUSE-SU-2016:0343-1: An update that solves two vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 821985,860991,964844 CVE References: CVE-2013-3571,CVE-2014-0019 Sources used: SUSE Linux Enterprise Server 11-SP4 (src): socat-1.7.0.0-1.18.2 SUSE Linux Enterprise Desktop 11-SP4 (src): socat-1.7.0.0-1.18.2 SUSE Linux Enterprise Debuginfo 11-SP4 (src): socat-1.7.0.0-1.18.2
released