sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()

Summary

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.

Remediation

1. Inventory every dlundquist sniproxy deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Patchhttps://github.com/renaudallard/sniproxy/commit/17986ba7397297313331297cac3b9eb3f0ba96b7
• Patchhttps://github.com/renaudallard/sniproxy/commit/d5d78290c8fe15d9aa12185d2c57739b7b0c6a6b
• Advisoryhttps://www.vulncheck.com/advisories/sniproxy-through-0.7.0-null-pointer-dereference-via-resolv-cancel
• Referencehttps://github.com/dlundquist/sniproxy
• Referencehttps://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/connection.c#L737-L738
• Referencehttps://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/resolv.c#L219-L224
• Referencehttps://github.com/dlundquist/sniproxy/issues/411