CVE Vulnerabilities

CVE-2011-3596

Reachable Assertion

Published: Nov 26, 2019 | Modified: Dec 04, 2019
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu

Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request.

Weakness

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Affected Software

Name Vendor Start Version End Version
Polipo Polipo_project * *
Polipo Ubuntu hardy *
Polipo Ubuntu lucid *
Polipo Ubuntu maverick *
Polipo Ubuntu natty *
Polipo Ubuntu oneiric *
Polipo Ubuntu precise *
Polipo Ubuntu quantal *
Polipo Ubuntu raring *
Polipo Ubuntu saucy *
Polipo Ubuntu upstream *
Polipo Ubuntu utopic *
Polipo Ubuntu vivid *
Polipo Ubuntu wily *

Extended Description

While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service. For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.

Potential Mitigations

References