CVE-2023-52389
📋 TL;DR
This CVE describes an integer overflow and stack buffer overflow vulnerability in POCO's UTF32Encoding component. When processing UTF-32 byte sequences with values of 0x80000000 or higher, the convert() and queryConvert() functions may return negative integers, leading to buffer overflows. This affects applications using vulnerable versions of the POCO C++ libraries.
💻 Affected Systems
- POCO C++ Libraries
📦 What is this software?
Poco by Pocoproject
Poco by Pocoproject
Poco by Pocoproject
Poco by Pocoproject
Poco by Pocoproject
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or service disruption.
Likely Case
Denial of service through application crashes or potential remote code execution in specific configurations.
If Mitigated
Application crashes with limited impact if proper memory protections and input validation are in place.
🎯 Exploit Status
Exploitation requires sending specially crafted UTF-32 data to vulnerable applications.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.8p2, 1.12.5p2, or 1.13.0
Vendor Advisory: https://pocoproject.org/blog/?p=1226
Restart Required: Yes
Instructions:
1. Identify POCO library version in use. 2. Update to patched version (1.11.8p2, 1.12.5p2, or 1.13.0). 3. Recompile applications with updated library. 4. Restart affected services.
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation to reject UTF-32 sequences with values >= 0x80000000.
Memory Protection
allEnable stack protection mechanisms like ASLR and DEP/PaX.
🧯 If You Can't Patch
- Implement network filtering to block or sanitize UTF-32 encoded data.
- Isolate vulnerable applications in restricted network segments or containers.
🔍 How to Verify
Check if Vulnerable:
Check POCO library version against affected versions. Review application code for UTF32Encoding usage.Check Version:
Check library files or build configuration for POCO version.Verify Fix Applied:
Verify POCO library version is 1.11.8p2, 1.12.5p2, or 1.13.0. Test with UTF-32 sequences >= 0x80000000.📡 Detection & Monitoring
Log Indicators:
- Application crashes, segmentation faults, or abnormal termination logs
Network Indicators:
- Unusual UTF-32 encoded network traffic patterns
SIEM Query:
Search for application crash events related to POCO-based services.🔗 References
- https://github.com/pocoproject/poco/compare/poco-1.12.5p2-release...poco-1.13.0-release
- https://github.com/pocoproject/poco/issues/4320
- https://pocoproject.org/blog/?p=1226
- https://github.com/pocoproject/poco/compare/poco-1.12.5p2-release...poco-1.13.0-release
- https://github.com/pocoproject/poco/issues/4320
- https://lists.debian.org/debian-lts-announce/2025/01/msg00017.html
- https://pocoproject.org/blog/?p=1226
