CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-20230 – stunnel: client certificate not correctly verified when redirect and verifyChain options are used
https://notcve.org/view.php?id=CVE-2021-20230
A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality. Se encontró un fallo en stunnel versiones anteriores a 5.57, donde comprueba inapropiadamente los certificados del cliente cuando está configurado para usar las opciones de redireccionamiento y verifyChain. Este fallo permite a un atacante con un certificado firmado por una Autoridad de Certificación, que no es el aceptado por el servidor de stunnel, para acceder al servicio de túnel en lugar de ser redireccionado a la dirección especificada en la opción de redireccionamiento. • https://bugzilla.redhat.com/show_bug.cgi?id=1925226 https://github.com/mtrojnar/stunnel/commit/ebad9ddc4efb2635f37174c9d800d06206f1edf9 https://security.gentoo.org/glsa/202105-02 https://access.redhat.com/security/cve/CVE-2021-20230 • CWE-295: Improper Certificate Validation •
CVSS: 4.3EPSS: 0%CPEs: 113EXPL: 0CVE-2014-0016
https://notcve.org/view.php?id=CVE-2014-0016
stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC (ECDSA) or DSA certificates. stunnel anterior a 5.00, cuando utilizando hilo de bifurcación, no actualiza debidamente el estado del generador de números psuedoaleatorios OpenSSL (PRNG), lo que causa que hijos posteriores con el mismo proceso ID utilicen el mismo pool de entropía y permite a atacantes remotos obtener claves privadas para certificados EC (ECDSA) o DSA. • http://www.openwall.com/lists/oss-security/2014/03/05/1 http://www.securityfocus.com/bid/65964 https://bugzilla.redhat.com/attachment.cgi?id=870826&action=diff https://bugzilla.redhat.com/show_bug.cgi?id=1072180 https://www.stunnel.org/sdf_ChangeLog.html • CWE-332: Insufficient Entropy in PRNG •
CVSS: 6.6EPSS: 1%CPEs: 34EXPL: 0CVE-2013-1762 – Stunnel: buffer overflow vulnerability due to incorrect integer conversion in the NTLM authentication of the CONNECT protocol negotiation
https://notcve.org/view.php?id=CVE-2013-1762
stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow. stunnel v4.21 a v4.54, cuando el protocolo de negociación CONNECT y la autenticación NTLM están habilitadas, no realiza la conversión de enteros correctamente, lo que permite ejecutar código de su elección a servidores remotos proxy a través de una solicitud hecha a mano que dispara un desbordamiento de búfer. • http://rhn.redhat.com/errata/RHSA-2013-0714.html http://www.debian.org/security/2013/dsa-2664 http://www.mandriva.com/security/advisories?name=MDVSA-2013:130 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0097 https://www.stunnel.org/CVE-2013-1762.html https://access.redhat.com/security/cve/CVE-2013-1762 https://bugzilla.redhat.com/show_bug.cgi?id=917839 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.2EPSS: 0%CPEs: 71EXPL: 0CVE-2008-2400
https://notcve.org/view.php?id=CVE-2008-2400
Unspecified vulnerability in stunnel before 4.23, when running as a service on Windows, allows local users to gain privileges via unknown attack vectors. Vulnerabilidad sin especificar en stunnel anterior a 4.23, cuando es ejecutado como un servicio en Windows, permite a usuarios locales obtener privilegios a través de vectores de ataque desconocidos. • http://secunia.com/advisories/30297 http://stunnel.mirt.net/pipermail/stunnel-announce/2008-May/000034.html http://www.securityfocus.com/bid/29285 http://www.securitytracker.com/id?1020049 http://www.vupen.com/english/advisories/2008/1568/references https://exchange.xforce.ibmcloud.com/vulnerabilities/42526 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.6EPSS: 0%CPEs: 23EXPL: 1CVE-2003-0740 – Stunnel 3.24/4.00 - Daemon Hijacking
https://notcve.org/view.php?id=CVE-2003-0740
Stunnel 4.00, and 3.24 and earlier, leaks a privileged file descriptor returned by listen(), which allows local users to hijack the Stunnel server. • https://www.exploit-db.com/exploits/91 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000736 http://marc.info/?l=bugtraq&m=106260760211958&w=2 http://www.mandriva.com/security/advisories?name=MDKSA-2003:108 http://www.redhat.com/support/errata/RHSA-2003-297.html https://access.redhat.com/security/cve/CVE-2003-0740 https://bugzilla.redhat.com/show_bug.cgi?id=1617077 •