[ GLSA 201208-01 ] socat: Arbitrary code execution

[GLSA]

Gentoo Linux Security Advisory

Title: socat: Arbitrary code execution (GLSA 201208-01)
Severity: high
Exploitable: local, remote
Date: August 14, 2012
Bug(s): #415977
ID: 201208-01

Synopsis

A buffer overflow in socat might allow remote attackers to execute
arbitrary code.


Background

socat is a multipurpose bidirectional relay, similar to netcat.

Affected Packages

Package: net-misc/socat
Vulnerable: < 1.7.2.1
Unaffected: >= 1.7.2.1
Architectures: All supported architectures


Description

A vulnerability in the "xioscan_readline()" function in xio-readline.c
could cause a heap-based buffer overflow.


Impact

A remote attacker could possibly execute arbitrary code with the
privileges of the socat process.


Workaround

There is no known workaround at this time.

Resolution

All socat users should upgrade to the latest version: