CyberRota Analysis
AI-GeneratedA stack-based out-of-bounds read vulnerability in the "s_vlog" function of stunnel can be exploited by remote attackers to send oversized log messages, potentially causing a crash of the service. This vulnerability primarily affects stunnel services that handle log messages exceeding 1024 bytes and could lead to information leakage or denial of service. Organizations utilizing stunnel should prioritize patching this vulnerability to mitigate potential risks associated with remote exploitation.
Original NVD Description
A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".