Ubuntu 22.04 LTS: USN-6148-1 Critical: SNI Proxy DoS Risk

ubuntu

June 12, 2023

SNI Proxy could be made to crash or run programs if it received specially crafted input.

Summary

SNI Proxy could be made to crash or run programs if it received specially

crafted input.

Software Description:

- sniproxy: Transparent TLS and HTTP layer 4 proxy with SNI support

Details:

It was discovered that SNI Proxy did not properly handle wildcard backend

hosts. An attacker could possibly use this issue to cause a buffer overflow,

resulting in a denial of service, or arbitrary code execution.

Topics Covered

security advisory denial of service buffer overflow critical ubuntu sni proxy

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
  sniproxy                        0.6.0-2ubuntu0.23.04.1

Ubuntu 22.10:
  sniproxy                        0.6.0-2ubuntu0.22.10.1

Ubuntu 22.04 LTS:
  sniproxy                        0.6.0-2ubuntu0.22.04.1

Ubuntu 20.04 LTS:
  sniproxy                        0.6.0-1ubuntu0.1

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
  sniproxy                        0.5.0-2ubuntu0.1~esm1

In general, a standard system update will make all the necessary changes.