Title

Out-of-bounds memory access when logging long protocol messages

Description

In affected versions, s_vlog() limits its stack buffer to 1,024 bytes but uses vsnprintf()'s would-have-written length when stripping trailing newlines. If a formatted message is longer than the buffer, stunnel reads beyond the buffer. If the byte read is a newline, stunnel also writes a NUL byte beyond the buffer.

The fix formats directly into a bounded, NUL-terminated buffer and derives the message length from the text actually stored in that buffer.

Exploitability

The vulnerability is exploitable under the following conditions:

A demonstrated remote path uses server-side IMAP protocol negotiation (protocol = imap) and an unexpected IMAP command longer than 1,024 bytes. Other protocol paths that log attacker-controlled text may also be affected. Lowering log verbosity is not a reliable workaround because some such messages are logged at the error level.

Impact

The out-of-bounds access may terminate or destabilize the stunnel process, causing a denial of service. The out-of-bounds write is limited to a NUL byte and depends on the adjacent stack contents. Reliable integrity impact or arbitrary code execution is considered very difficult and likely impractical; no confidentiality impact has been established. The practical risk is assessed as Moderate.

CVSS v3.1 Score

CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Recommendation

Upgrade to stunnel 5.80 or later.

Until an upgrade is possible, avoid exposing protocol-negotiation services that log untrusted protocol input, or restrict them to trusted clients and networks.

Credits

Timeline

Our supporters:
Go to the top