==================================================================== CERT-Renater Note d'Information No. 2018/VULN099 _____________________________________________________________________ DATE : 14/03/2018 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running curl versions 7.20.0 up to and including 7.58.0. ===================================================================== https://curl.haxx.se/docs/adv_2018-9cd6.html https://curl.haxx.se/docs/adv_2018-97a2.html https://curl.haxx.se/docs/adv_2018-b047.html _____________________________________________________________________ FTP path trickery leads to NIL byte out of bounds write ======================================================= Project curl Security Advisory, March 14th 2018 - [Permalink](https://curl.haxx.se/docs/adv_2018-9cd6.html) VULNERABILITY ------------- curl can be fooled into writing a zero byte out of bounds. This bug can trigger when curl is told to work on an FTP URL, with the setting to only issue a single CWD command (`--ftp-method singlecwd` or the libcurl alternative `CURLOPT_FTP_FILEMETHOD`). curl then URL-decodes the given path, calls strlen() on the result and deducts the length of the file name part to find the end of the directory within the buffer. It then writes a zero byte on that index, in a buffer allocated on the heap. If the directory part of the URL contains a "%00" sequence, the directory length might end up shorter than the file name path, making the calculation `size_t index = directory_len - filepart_len` end up with a huge index variable for where the zero byte gets stored: `heap_buffer[index] = 0`. On several architectures that huge index will wrap and work as a negative value, thus overwriting memory *before* the intended heap buffer. By using different file part lengths and putting %00 in different places in the URL, an attacker that can control what paths a curl-using application uses can write that zero byte on different indexes. We are not aware of any exploit of this flaw. INFO ---- This bug was introduced in December 2004 in [this commit](https://github.com/curl/curl/commit/6e1e9caa32da0995). The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2018-1000120 to this issue. CWE-122: Heap-based Buffer Overflow AFFECTED VERSIONS ----------------- - Affected versions: curl 7.12.3 to and including curl 7.58.0 - Not affected versions: curl < 7.12.3 and curl >= 7.59.0 libcurl is used by many applications, but not always advertised as such. THE SOLUTION ------------ In curl version 7.59.0, curl rejects FTP URLs that contain any "control characters". That is byte values below ascii 32. A [patch for CVE-2018-1000120] (https://curl.haxx.se/CVE-2018-1000120.patch) is available. RECOMMENDATIONS --------------- We suggest you take one of the following actions immediately, in order of preference: A - Upgrade curl to version 7.59.0 B - Apply the patch to your version and rebuild C - Do not enable singlecwd mode for FTP transfers TIME LINE --------- It was reported to the curl project on January 29, 2018 We contacted distros@...nwall on March 7, 2018. curl 7.59.0 was released on March 14 2018, coordinated with the publication of this advisory. CREDITS ------- Reported by Duy Phan Thanh. Patch by Daniel Stenberg. Thanks a lot! / daniel.haxx.se _____________________________________________________________________ LDAP NULL pointer dereference ============================= Project curl Security Advisory, March 14th 2018 - (https://curl.haxx.se/docs/adv_2018-97a2.html) VULNERABILITY ------------- curl might dereference a near-NULL address when getting an LDAP URL. The function `ldap_get_attribute_ber()` is called to get attributes, but it turns out that it can return `LDAP_SUCCESS` and still return a `NULL` pointer in the result pointer when getting a particularly crafted response. This was a surprise to us and to the code. libcurl-using applications that allow LDAP URLs, or that allow redirects to LDAP URLs could be made to crash by a malicious server. We are not aware of any exploit of this flaw. INFO ---- The bug is only present in curl versions built to use OpenLDAP. This bug was introduced in May 2010 in [this commit](https://github.com/curl/curl/commit/2e056353b00d09). The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2018-1000121 to this issue. CWE-476: NULL Pointer Dereference AFFECTED VERSIONS ----------------- - Affected versions: curl 7.21.0 to and including curl 7.58.0 - Not affected versions: curl < 7.21.0 and curl >= 7.59.0 libcurl is used by many applications, but not always advertised as such. THE SOLUTION ------------ In curl version 7.59.0, curl checks the pointer properly before using it. A [patch for CVE-2018-1000121](https://curl.haxx.se/CVE-2018-1000121.patch) is available. RECOMMENDATIONS --------------- We suggest you take one of the following actions immediately, in order of preference: A - Upgrade curl to version 7.59.0 B - Apply the patch to your version and rebuild C - Make sure you disable LDAP in your transfers TIME LINE --------- It was reported to the curl project on March 6, 2018 We contacted distros@...nwall on March 7, 2018. curl 7.59.0 was released on March 14 2018, coordinated with the publication of this advisory. CREDITS ------- Reported by Dario Weisser. Patch by Daniel Stenberg. Thanks a lot! / daniel.haxx.se _____________________________________________________________________ RTSP RTP buffer over-read ========================= Project curl Security Advisory, March 14th 2018 - [Permalink](https://curl.haxx.se/docs/adv_2018-b047.html) VULNERABILITY ------------- curl can be tricked into copying data beyond end of its heap based buffer. When asked to transfer an RTSP URL, curl could calculate a wrong data length to copy from the read buffer. The memcpy call would copy data from the heap following the buffer to a storage area that would subsequently be delivered to the application (if it didn't cause a crash). We've managed to get it to reach several hundreds bytes out of range. This could lead to information leakage or a denial of service for the application if the server offering the RTSP data can trigger this. We are not aware of any exploit of this flaw. INFO ---- This bug was introduced in January 2010 in [this commit] (https://github.com/curl/curl/commit/bc4582b68a673d3) when RTSP support was first added. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2018-1000122 to this issue. CWE-126: Buffer Over-read AFFECTED VERSIONS ----------------- - Affected versions: curl 7.20.0 to and including curl 7.58.0 - Not affected versions: curl < 7.20.0 and curl >= 7.59.0 libcurl is used by many applications, but not always advertised as such. THE SOLUTION ------------ In curl version 7.59.0, curl makes sure that this code never gets told to copy more data than it is allowed to read from the buffer. A [patch for CVE-2018-1000122](https://curl.haxx.se/CVE-2018-1000122.patch) is available. RECOMMENDATIONS --------------- We suggest you take one of the following actions immediately, in order of preference: A - Upgrade curl to version 7.59.0 B - Apply the patch to your version and rebuild TIME LINE --------- It was reported to the curl project on February 20, 2018 We contacted distros@...nwall on March 8, 2018. curl 7.59.0 was released on March 14 2018, coordinated with the publication of this advisory. CREDITS ------- Detected by OSS-fuzz. Assisted by Max Dymond. Patch by Daniel Stenberg. Thanks a lot! ========================================================== + CERT-RENATER | tel : 01-53-94-20-44 + + 23 - 25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email: cert@support.renater.fr + ==========================================================