From: "Ulf Harnhammar" <metaur@operamail.com>
To: curl-security@haxx.se
Subject: cURL tftp:// URL Buffer Overflow
Date: Fri, 10 Mar 2006 16:32:13 +0100


cURL tftp:// URL Buffer Overflow

There is a buffer overflow in cURL when it fetches a tftp:// URL
with a size of >66000 characters. The URL must start with "tftp://",
then a valid hostname, and then another slash.

The bug affects cURL versions 7.15.2, 7.15.1 and 7.15.0.

Successful exploitation of this vulnerability allows attackers to
execute code within the context of cURL. There are many programs
that allow remote users to access cURL, for instance through its
PHP bindings that let a PHP web developer write a web application
that uses cURL on the web server to access a remote resource on the
Internet. In such a case, if the web application does not check
for very long URLs, any user of the web application may submit a
URL that will be passed to cURL, causing a buffer overflow in it.

If cURL is configured to follow HTTP redirects, for example by using
its -L command line option, any web resource can redirect to a tftp://
URL that causes this overflow.

If cURL is compiled with "./configure --disable-tftp && make",
the whole TFTP support in the program is disabled. This secures it
effectively against this vulnerability, but some users may wish
to use the program's TFTP capabilities, making it an undesirable
workaround for them.

I have attached an unofficial patch and a PHP script that exhibits
redirecting from a web resource to a dangerous tftp:// URL.

I hope that we can coordinate our respective cURL updates to solve
this issue in a proper manner.

// Ulf Harnhammar, Swedish Security Audit Group



--- curl-7.15.1_UNPATCHED/lib/tftp.c
+++ curl-7.15.1/lib/tftp.c
@@ -271,7 +271,7 @@
         /* If we are downloading, send an RRQ */
         state->spacket.event = htons(TFTP_EVENT_RRQ);
       }
-    sprintf((char *)state->spacket.u.request.data, "%s%c%s%c",
+    snprintf((char *)state->spacket.u.request.data, 512, "%s%c%s%c",
               filename, '\0',  mode, '\0');
       sbytes = 4 + (int)strlen(filename) + (int)strlen(mode);
       sbytes = sendto(state->sockfd, (void *)&state->spacket,



<?php

header('Location: tftp://localhost/' . str_repeat('U', 197000));

?>