Stunnel CLOEXEC File Descriptor Leak Local Information Disclosure Vulnerability
BID:46313
Info
Stunnel CLOEXEC File Descriptor Leak Local Information Disclosure Vulnerability
| Bugtraq ID: | 46313 |
| Class: | Race Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 05 2011 12:00AM |
| Updated: | Feb 05 2011 12:00AM |
| Credit: | This issue was disclosed by the vendor. |
| Vulnerable: |
Stunnel Stunnel 4.0 4 Stunnel Stunnel 4.0 3 Stunnel Stunnel 4.0 2 Stunnel Stunnel 4.0 1 Stunnel Stunnel 4.0 0 Stunnel Stunnel 3.26 Stunnel Stunnel 3.25 Stunnel Stunnel 3.24 Stunnel Stunnel 3.22 Stunnel Stunnel 3.21 c Stunnel Stunnel 3.21 b Stunnel Stunnel 3.21 a Stunnel Stunnel 3.21 Stunnel Stunnel 3.19 Stunnel Stunnel 3.18 Stunnel Stunnel 3.17 Stunnel Stunnel 3.16 Stunnel Stunnel 3.15 Stunnel Stunnel 3.14 Stunnel Stunnel 3.13 Stunnel Stunnel 3.12 Stunnel Stunnel 3.11 Stunnel Stunnel 3.9 Stunnel Stunnel 3.8 Stunnel Stunnel 3.7 Stunnel Stunnel 3.4 a Stunnel Stunnel 3.3 Stunnel Stunnel 4.34 Stunnel Stunnel 4.33 Stunnel Stunnel 4.32 Stunnel Stunnel 4.31 Stunnel Stunnel 4.30 Stunnel Stunnel 4.24 Stunnel Stunnel 4.23 Stunnel Stunnel 4.22 Stunnel Stunnel 3.20 Stunnel Stunnel 3.10 |
| Not Vulnerable: |
Stunnel Stunnel 4.35 |
Discussion
Stunnel CLOEXEC File Descriptor Leak Local Information Disclosure Vulnerability
Stunnel is prone to a local information-disclosure vulnerability because it may leak CLOEXEC file descriptors in a race condition.
Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks.
Versions prior to Stunnel 4.35 are vulnerable.
NOTE: Stunnel on some Unix platforms is irreparably vulnerable.
Stunnel is prone to a local information-disclosure vulnerability because it may leak CLOEXEC file descriptors in a race condition.
Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks.
Versions prior to Stunnel 4.35 are vulnerable.
NOTE: Stunnel on some Unix platforms is irreparably vulnerable.
Exploit / POC
Stunnel CLOEXEC File Descriptor Leak Local Information Disclosure Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Stunnel CLOEXEC File Descriptor Leak Local Information Disclosure Vulnerability
Solution:
Updates are available. Note that some Unix deployments may be irreparably vulnerable. Please see the references for more information.
Solution:
Updates are available. Note that some Unix deployments may be irreparably vulnerable. Please see the references for more information.
References
Stunnel CLOEXEC File Descriptor Leak Local Information Disclosure Vulnerability
References:
References:
- Stunnel Homepage (Stunnel)
- Version 4.35, 2011.02.05, urgency: LOW: (Stunnel)