Bugzilla – Bug 65752
VUL-0: CVE-2005-0490: curl: several vulnerabilities
Last modified: 2021-10-27 11:40:10 UTC
Hi, looks like iDEFENSE found several vulnerabilities in curl. We have no details yet. I'll come back when I know more. Thread-Topic: iDEFENSE Security Advisories - Multiple Vulnerabilities in cURL/libcURL [IDEF0752], [IDEF0748] Thread-Index: AcUPlEvCwynkMpNpRuuApyu3t3wm5A== From: vendor-disclosure <vendor-disclosure@idefense.com> To: vendor-sec@lst.de Cc: vendor-disclosure <vendor-disclosure@idefense.com> Subject: [vendor-sec] iDEFENSE Security Advisories - Multiple Vulnerabilities in cURL/libcURL [IDEF0752], [IDEF0748] Errors-To: vendor-sec-admin@lst.de Date: Thu, 10 Feb 2005 12:16:17 -0500 We have attempted to contact the maintainers of the cURL/libcURL projects at curl-web@haxx.se, without success. If anyone has appropriate contact information for these projects, it would be greatly appreciated if you could pass it along. Michael
<!-- SBZ_reproduce --> -
Issue is NOT public. Please keep inside suse.
Multiple Unix/Linux Vendor cURL/libcURL NTLM Authentication Buffer Overflow Vulnerability iDEFENSE Security Advisory 02.21.05: www.idefense.com/application/poi/display?id=202&type=vulnerabilities February 21, 2005 I. BACKGROUND cURL is a command line tool for transferring files with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE and LDAP. More information about cURL and libcURL is available from: http://curl.haxx.se/ II. DESCRIPTION Remote exploitation of a stack-based buffer overflow in various Unix / Linux vendors implementations of cURL could allow for arbitrary code execution on the targeted host. An exploitable stack-based buffer overflow condition exists when using NT Lan Manager (NTLM) authentication. The problem specifically exists within Curl_input_ntlm() defined in lib/http_ntlm.c. Within this function an unsigned stack-based character array of size 256, buffer[], is passed to the Curl_base64_decode() routine defined in lib/base64.c as can be seen here: size_t size = Curl_base64_decode(header, (char *)buffer); The Curl_base64_decode() routine relies on the calling function to validate the decoded length. This function base64 decodes and copies data directly from the HTTP reply of a server to the destination buffer, in this case buffer[]. An attacker can construct a long base64 encoded malicious payload that upon decoding will overflow the 256 byte static buffer and overwrite the saved EIP. This in turn can lead to arbitrary code execution. III. ANALYSIS Successful exploitation allows remote attackers to execute arbitrary code under the privileges of the target user. Exploitation requires that an attacker either coerce or force a target to connect to a malicious server using NTLM authentication. IV. DETECTION iDEFENSE has confirmed the existence of this vulnerability in cURL version 7.12.1. It is suspected that prior versions are affected as well. Any application built using a vulnerable version libcURL will also be affected. V. WORKAROUND Replace the static buffer allocation on line 106 in lib/http_ntlm.c: unsigned char buffer[256]; With a dynamic buffer allocation: unsigned char *buffer = (unsigned char *)malloc(strlen(header)); and recompile cURL. VI. VENDOR RESPONSE No vendor response received. VII. CVE INFORMATION A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not been assigned yet. VIII. DISCLOSURE TIMELINE 12/21/2004 Initial vendor notification - No response 02/10/2005 Secondary vendor notification - No response 02/21/2005 Public disclosure IX. CREDIT infamous41md[at]hotpop.com is credited with this discovery.
Multiple Unix/Linux Vendor cURL/libcURL Kerberos Authentication Buffer Overflow Vulnerability iDEFENSE Security Advisory 02.21.05: www.idefense.com/application/poi/display?id=203&type=vulnerabilities February 21, 2005 I. BACKGROUND cURL is a command line tool for transferring files with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE and LDAP. More information about cURL and libcURL is available from: http://curl.haxx.se/ II. DESCRIPTION Remote exploitation of a stack-based buffer overflow in various Unix / Linux vendors' implementation of cURL could allow for arbitrary code execution on the targeted host. An exploitable stack-based buffer overflow condition exists when using Kerberos authentication. The problem specifically exists within the functions Curl_krb_kauth() and krb4_auth() defined in lib/krb4.c. Within these functions a statically allocated stack-based buffer of size 1250, from struct KTEXT_ST.dat, is passed to the Curl_base64_decode() routine defined in lib/base64.c as can be seen here: len = Curl_base64_decode(p, (char *)adat.dat); tmp = Curl_base64_decode(p, (char *)tkt.dat); The Curl_base64_decode() routine relies on the calling function to validate the decoded length. This function base64 decodes and copies data directly from the HTTP reply of a server to the destination buffer, in this case buffer[]. An attacker can construct a long base64 encoded malicious payload that upon decoding will overflow the static buffer and overwrite the saved EIP. This in turn can lead to arbitrary code execution. III. ANALYSIS Successful exploitation allows remote attackers to execute arbitrary code under the privileges of the target user. Exploitation requires that an attacker either coerce or force a target to connect to a malicious server using Kerberos authentication. IV. DETECTION iDEFENSE has confirmed the existence of this vulnerability in cURL version 7.12.1. It is suspected that prior versions are affected as well. Any application built using a vulnerable version libcURL will also be affected. V. WORKAROUND Recompile cURL without Kerberos support if it is not needed. VI. VENDOR RESPONSE No vendor response received. VII. CVE INFORMATION A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not been assigned yet. VIII. DISCLOSURE TIMELINE 12/23/2004 Initial vendor notification - No response 02/10/2005 Secondary vendor notification - No response 02/21/2005 Public disclosure IX. CREDIT infamous41md[at]hotpop.com is credited with this discovery.
(In reply to comment #4) > Recompile cURL without Kerberos support if it is not needed. We have cURL without Kerberos support.
yes, but i think NTLM support is enabled, right?
(In reply to comment #3) > iDEFENSE has confirmed the existence of this vulnerability in cURL > version 7.12.1. It is suspected that prior versions are affected as > well. Only versions since 7.11.0 contain NTML, so only these are affected. It means versions we have in sles9 and 9.2.
swampid: 444
Fixed packages submited.
Created attachment 28679 [details] curl.patch.box box patchinfo i just submitted
Created attachment 28680 [details] curl.patch.maintained maintained patchinfo i just submitted
Michal, the malloc/free are mismatched, in the else branch the buffer is not freed. i would suggest allocating only in the if(*header) { branch
Ooops, I wanted to move malloc inside if, but forgout about it.
Should be okay now.
Created attachment 28872 [details] curl-ntlm-bad.reply sample bad reply. will cause segfault.
testcase: run: $ netcat -l -p 8888 <curl-ntlm-bad.reply on other shell run: $ curl --ntlm http://localhost:8888/ Segmentation fault With fixed it should report: $ curl --ntlm http://localhost:8888/ curl: (7) Connect failed $ One set of HTTP headers should appear on the netcat side both times.
CAN-2005-0490
fixed packages + advisory released
What's with this compat-curl2 submission for 9.2?
must have been forgotten. I've submitted a patchinfo for them
rekeased update.
CVE-2005-0490: CVSS v2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)