-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

3proxy double free vulnerability
[Security Advisory]

Advisory: [AD_LAB-07006] 3proxy double free vulnerability
Class: Design Error
DATE:10/22/2007
CVEID:CVE-2007-5622
Vulnerable:
3proxy <=0.5.3i
Vendor:
http://www.3proxy.ru/

I.Synopsis

A vulnerability has been discovered in 3proxy.

II.DETAILS:

Background

3proxy is a multi-protocol proxy, including HTTP/HTTPS/FTP and SOCKS
support.

Description

    There is a double free vulnerability in function ftpprchild().

…
if (!strncasecmp((char *)buf, "OPEN ", 5)){
if(param->hostname) myfree(param->hostname); <–first free
if(parsehostname((char *)buf+5, param, 21)){RETURN(803);}

the parsehostname will free param->hostname again.
int parsehostname(char *hostname, struct clientparam *param, unsigned
short port){
char *sp;

            if(!hostname || !*hostname)return 1;
            if ( (sp = strchr(hostname, ':')) ) *sp = 0;
            if(param->hostname) myfree(param->hostname); <-- double free

Impact
A remote attacker can cause instability and potentially crash a service by
issuing "OPEN" command for FTP proxy more than once.

Resolution

New version can be downloaded from

http://3proxy.ru/download/

III.CREDIT:

Venustech AD-LAB discovery this vuln. Thank to all Venustech AD-Lab

guys.

V.DISCLAIMS:

The information in this bulletin is provided "AS IS" without warranty of
any
kind. In no event shall we be liable for any damages whatsoever
including direct,
indirect, incidental, consequential, loss of business profits or special
damages.

Copyright 1996-2007 VENUSTECH. All Rights Reserved. Terms of use.

VENUSTECH Security Lab
VENUSTECH INFORMATION TECHNOLOGY CO.,LTD(http://www.venustech.com.cn)

Security
Trusted {Solution} Provider
Service
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHHhVrFVSdIDJXOo0RAsphAJ4zHLat+GcjOtwcz5C0gFA1Mc8zEQCdFG1g
pCTMq/tnk2Lkc+AGQq7gm0U=
=Zi/2
-----END PGP SIGNATURE-----

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/