Polipo Malformed HTTP GET Request Memory Corruption Vulnerability

Bugtraq ID:	37226
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Dec 07 2009 12:00AM
Updated:	Dec 09 2009 05:04PM
Credit:	Jeremy Brown
Vulnerable:	Polipo Polipo 1.0.4 Polipo Polipo 0.9.8
Not Vulnerable:

Polipo Malformed HTTP GET Request Memory Corruption Vulnerability

Polipo is prone to a memory-corruption vulnerability.

Successful exploits may allow remote attackers to execute arbitrary code within the context of the affected application or crash the application, denying service to legitimate users.

Polipo 0.9.8 and 1.0.4 are vulnerable; other versions may also be affected.

Polipo Malformed HTTP GET Request Memory Corruption Vulnerability

The following proof of concept is available:

• /data/vulnerabilities/exploits/37226.pl

Polipo Malformed HTTP GET Request Memory Corruption Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Polipo Malformed HTTP GET Request Memory Corruption Vulnerability

References:

• Polipo Homepage (Polipo)