Bug 65752 (CVE-2005-0490)

<!-- SBZ_reproduce  -->
-

Issue is NOT public. Please keep inside suse. 

Multiple Unix/Linux Vendor cURL/libcURL NTLM Authentication Buffer 
Overflow Vulnerability 
 
iDEFENSE Security Advisory 02.21.05: 
www.idefense.com/application/poi/display?id=202&type=vulnerabilities 
February 21, 2005 
 
I. BACKGROUND 
 
cURL is a command line tool for transferring files with URL syntax, 
supporting FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE and LDAP. 
More information about cURL and libcURL is available from: 
 
    http://curl.haxx.se/ 
 
II. DESCRIPTION 
 
Remote exploitation of a stack-based buffer overflow in various Unix / 
Linux vendors implementations of cURL could allow for arbitrary code 
execution on the targeted host. 
 
An exploitable stack-based buffer overflow condition exists when using 
NT Lan Manager (NTLM) authentication. The problem specifically exists 
within Curl_input_ntlm() defined in lib/http_ntlm.c. Within this 
function an unsigned stack-based character array of size 256, buffer[], 
is passed to the Curl_base64_decode() routine defined in lib/base64.c as 
can be seen here: 
 
    size_t size = Curl_base64_decode(header, (char *)buffer); 
 
The Curl_base64_decode() routine relies on the calling function to 
validate the decoded length. This function base64 decodes and copies 
data directly from the HTTP reply of a server to the destination buffer, 
in this case buffer[]. An attacker can construct a long base64 encoded 
malicious payload that upon decoding will overflow the 256 byte static 
buffer and overwrite the saved EIP. This in turn can lead to arbitrary 
code execution. 
 
III. ANALYSIS 
 
Successful exploitation allows remote attackers to execute arbitrary 
code 
under the privileges of the target user. Exploitation requires that an 
attacker either coerce or force a target to connect to a malicious 
server using NTLM authentication. 
 
IV. DETECTION 
 
iDEFENSE has confirmed the existence of this vulnerability in cURL 
version 7.12.1. It is suspected that prior versions are affected as 
well. 
Any application built using a vulnerable version libcURL will also be 
affected. 
 
V. WORKAROUND 
 
Replace the static buffer allocation on line 106 in lib/http_ntlm.c: 
 
    unsigned char buffer[256]; 
 
With a dynamic buffer allocation: 
 
    unsigned char *buffer = (unsigned char *)malloc(strlen(header));   
 
and recompile cURL. 
 
VI. VENDOR RESPONSE 
 
No vendor response received. 
 
VII. CVE INFORMATION 
 
A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not 
been assigned yet. 
 
VIII. DISCLOSURE TIMELINE 
 
12/21/2004  Initial vendor notification - No response 
02/10/2005  Secondary vendor notification - No response 
02/21/2005  Public disclosure 
IX. CREDIT 
 
infamous41md[at]hotpop.com is credited with this discovery. 
 
 

Multiple Unix/Linux Vendor cURL/libcURL Kerberos Authentication Buffer 
Overflow Vulnerability 
 
iDEFENSE Security Advisory 02.21.05: 
www.idefense.com/application/poi/display?id=203&type=vulnerabilities 
February 21, 2005 
 
I. BACKGROUND 
 
cURL is a command line tool for transferring files with URL syntax, 
supporting FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE and LDAP. 
More information about cURL and libcURL is available from: 
 
    http://curl.haxx.se/ 
 
II. DESCRIPTION 
 
Remote exploitation of a stack-based buffer overflow in various Unix / 
Linux vendors' implementation of cURL could allow for arbitrary code 
execution on the targeted host. 
 
An exploitable stack-based buffer overflow condition exists when using 
Kerberos authentication. The problem specifically exists within the 
functions Curl_krb_kauth() and krb4_auth() defined in lib/krb4.c. 
Within these functions a statically allocated stack-based buffer of size 
1250, from struct KTEXT_ST.dat, is passed to the Curl_base64_decode() 
routine defined in lib/base64.c as can be seen here: 
 
    len = Curl_base64_decode(p, (char *)adat.dat); 
    tmp = Curl_base64_decode(p, (char *)tkt.dat); 
 
The Curl_base64_decode() routine relies on the calling function to 
validate the decoded length. This function base64 decodes and copies 
data directly from the HTTP reply of a server to the destination buffer, 
in this case buffer[]. An attacker can construct a long base64 encoded 
malicious payload that upon decoding will overflow the static buffer and 
overwrite the saved EIP. This in turn can lead to arbitrary code 
execution. 
 
III. ANALYSIS 
 
Successful exploitation allows remote attackers to execute arbitrary 
code 
under the privileges of the target user. Exploitation requires that an 
attacker either coerce or force a target to connect to a malicious 
server using Kerberos authentication. 
 
IV. DETECTION 
 
iDEFENSE has confirmed the existence of this vulnerability in cURL   
version 7.12.1. It is suspected that prior versions are affected as 
well. 
Any application built using a vulnerable version libcURL will also be 
affected. 
 
V. WORKAROUND 
 
Recompile cURL without Kerberos support if it is not needed. 
 
VI. VENDOR RESPONSE 
 
No vendor response received. 
 
VII. CVE INFORMATION 
 
A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not 
been assigned yet. 
 
VIII. DISCLOSURE TIMELINE 
 
12/23/2004  Initial vendor notification - No response 
02/10/2005  Secondary vendor notification - No response 
02/21/2005  Public disclosure 
 
IX. CREDIT 
 
infamous41md[at]hotpop.com is credited with this discovery. 
 

(In reply to comment #4)
> Recompile cURL without Kerberos support if it is not needed. 

We have cURL without Kerberos support.

yes, but i think NTLM support is enabled, right? 
 

(In reply to comment #3)
> iDEFENSE has confirmed the existence of this vulnerability in cURL 
> version 7.12.1. It is suspected that prior versions are affected as 
> well. 

Only versions since 7.11.0 contain NTML, so only these are affected. It means
versions we have in sles9 and 9.2.

swampid: 444 

Fixed packages submited.

Created attachment 28679 [details]
curl.patch.box

box patchinfo i just submitted

Created attachment 28680 [details]
curl.patch.maintained

maintained patchinfo i just submitted

Michal, the malloc/free are mismatched, in the else branch the 
buffer is not freed. 
 
i would suggest allocating only in the if(*header) { branch 
 

Ooops, I wanted to move malloc inside if, but forgout about it.

Should be okay now.

Created attachment 28872 [details]
curl-ntlm-bad.reply

sample bad reply.

will cause segfault.

testcase: run: 
 
$ netcat -l -p 8888 <curl-ntlm-bad.reply 
 
on other shell run: 
 
$ curl --ntlm http://localhost:8888/ 
Segmentation fault 
 
With fixed it should report: 
$ curl --ntlm http://localhost:8888/ 
curl: (7) Connect failed 
$ 
 
One set of HTTP headers should appear on the netcat side both times. 

CAN-2005-0490 

fixed packages + advisory released 

What's with this compat-curl2 submission for 9.2? 

must have been forgotten. I've submitted a patchinfo for them 

rekeased update. 

CVE-2005-0490: CVSS v2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)