Unscored severity · published Mar 8, 2013
CVE-2013-1762
stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers…
–
CVSS
2.9%
EPSS
No
On KEV
Description
stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Stunnel · Stunnel
through 4.54; 4.21; 4.22; 4.23; 4.24; 4.25; +28 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1762
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1762
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0714.html
www.debian.org
http://www.debian.org/security/2013/dsa-2664
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2013:130
wiki.mageia.org
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0097
Vendor Advisory
https://www.stunnel.org/CVE-2013-1762.html
More from Stunnel
7.5
CVE-2021-20230
A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options
–
CVE-2015-3644
Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers…
–
CVE-2014-0016
stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the…
–
CVE-2011-2940
stunnel 4.40 and 4.41 might allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors
–
CVE-2008-2420
The OCSP functionality in stunnel before 4.24 does not properly search certificate revocation lists (CRL), which allows remote attackers to bypass intended access restrictions by…