[<prev] [next>] [day] [month] [year] [list]
Message-ID: <alpine.DEB.2.20.1708090802180.7715@tvnag.unkk.fr>
Date: Wed, 9 Aug 2017 08:05:41 +0200 (CEST)
From: Daniel Stenberg <daniel@...x.se>
To: curl security announcements -- curl users <curl-users@...l.haxx.se>,
curl-announce@...l.haxx.se,
libcurl hacking <curl-library@...l.haxx.se>,
oss-security@...ts.openwall.com
Subject: [SECURITY ADVISORY] curl: URL globbing out of bounds read
URL globbing out of bounds read
===============================
Project curl Security Advisory, August 9th 2017 -
[Permalink](https://curl.haxx.se/docs/adv_20170809A.html)
VULNERABILITY
-------------
curl supports "globbing" of URLs, in which a user can pass a numerical range
to have the tool iterate over those numbers to do a sequence of transfers.
In the globbing function that parses the numerical range, there was an
omission that made curl read a byte beyond the end of the URL if given a
carefully crafted, or just wrongly written, URL. The URL is stored in a heap
based buffer, so it could then be made to wrongly read something else instead
of crashing.
An example of a URL that triggers the flaw would be
`http://ur%20[0-60000000000000000000`.
We are not aware of any exploit of this flaw.
INFO
----
This flaw only affects the curl command line tool, not the libcurl
library. The bug was introduced in commit
[5ca96cb84410270](https://github.com/curl/curl/commit/5ca96cb84410270), August
2013. curl 7.34.0.
For version 7.55.0, the parser properly stops at the end of the string and a
test has been added to verify this.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2017-1000101 to this issue.
AFFECTED VERSIONS
-----------------
- Affected versions: curl 7.34.0 to and including 7.54.1
- Not affected versions: curl < 7.34.0 and >= 7.55.1
curl is used by many applications, but not always advertised as such.
THE SOLUTION
------------
A [patch for CVE-2017-1000101](https://curl.haxx.se/CVE-2017-1000101.patch) is
available.
RECOMMENDATIONS
---------------
We suggest you take one of the following actions immediately, in order of
preference:
A - Upgrade curl to version 7.55.0
B - Apply the patch to your version and rebuild
TIME LINE
---------
It was reported to the curl project on June 14, 2017. We contacted
distros@...nwall on August 1.
curl 7.55.0 was released on August 9 2017, coordinated with the publication of
this advisory.
CREDITS
-------
Reported by Brian Carpenter and Yongji Ouyang (independently of each
other). Patch by Daniel Stenberg.
Thanks a lot!
--
/ daniel.haxx.se
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
