icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons_061

Curl < 7.15.3 TFTP URL Parsing Overflow

High

Synopsis

The remote host is vulnerable to a buffer overflow.

Description

The remote host is using a version of curl (or libcurl) that is vulnerable to a remote buffer overflows. An attacker would have to set up a rogue web server and entice a curl user to browse to the malicious server to exploit this vulnerability. Upon successful exploitation, the attacker would be able to execute arbitrary commands with the rights of the web server. The specific flaw occurs when processing long 'tftp://' URIs. E.g., tftp://www.somesite.com/[512 bytes]

Solution

Upgrade to version 7.15.3 or higher.