CVE-2023-25076: 
SNIPROXY vulnerability analysis and mitigation

A critical buffer overflow vulnerability (CVE-2023-25076) was discovered in SNIProxy versions 0.6.0-2 and the master branch (commit: 822bb80df9b7b345cc9eba55df74a07b498819ba). SNIProxy is an open-source application that reverse proxies HTTP and TLS connections based on the requested hostname. The vulnerability was discovered on March 16, 2023, and publicly disclosed on March 30, 2023 (Talos Report).

The vulnerability exists in the handling of wildcard backend hosts, specifically in the new_address() function when parsing IPv6 address strings. The issue occurs because the source length is used in a string copy rather than destination length when copying into a stack buffer of size 262. While TLS libraries typically limit SNI hostname values to 256 bytes, SNIProxy implements its own parsing, allowing arbitrary length values. The vulnerability has received a CVSS v3.1 score of 9.8 (Critical) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Talos Report).

The vulnerability allows an attacker to achieve remote code execution or cause a denial of service by sending a specially crafted HTTP, TLS, or DTLS packet. When exploited, the buffer overflow can lead to arbitrary code execution, potentially giving attackers complete control over the affected system (Talos Report).

The vulnerability has been patched in version 0.6.1 of SNIProxy. The fix prevents the string copy from overflowing the destination buffer and ensures proper null termination. Various Linux distributions have also released security updates: Debian 11 (bullseye) fixed in version 0.6.0-2+deb11u1, Debian 10 (buster) fixed in version 0.6.0-1+deb10u1 (Debian Advisory, GitHub Patch).