Multiple off-by-one errors in the cURL library (libcurl) 7.11.2 through 7.15.0 allow local users to trigger a buffer overflow and cause a denial of service or bypass PHP security restrictions via certain URLs that (1) are malformed in a way that prevents a terminating null byte from being added to either a hostname or path buffer, or (2) contain a "?" separator in the hostname portion, which causes a "/" to be prepended to the resulting string.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

The upstream developer of curl, a multi-protocol file transfer library, informed us that the former correction to several off-by-one errors are not sufficient. For completeness please find the original bug description below :

  Several problems were discovered in libcurl, a multi-protocol file   transfer library. The Common Vulnerabilities and Exposures project   identifies the following problems :

    - CVE-2005-3185       A buffer overflow has been discovered in libcurl that       could allow the execution of arbitrary code.

    - CVE-2005-4077       Stefan Esser discovered several off-by-one errors that       allows local users to trigger a buffer overflow and       cause a denial of service or bypass PHP security       restrictions via certain URLs.

Updated curl packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and Dict servers, using any of the supported protocols.

Stefan Esser discovered an off-by-one bug in curl. It may be possible to execute arbitrary code on a user's machine if the user can be tricked into executing curl with a carefully crafted URL. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-4077 to this issue.

All users of curl are advised to upgrade to these updated packages, which contain a backported patch that resolves this issue.

A Project cURL Security Advisory reports :

libcurl's URL parser function can overflow a malloced buffer in two ways, if given a too long URL.

1 - pass in a URL with no protocol (like 'http://') prefix, using no slash and the string is 256 bytes or longer. This leads to a single zero byte overflow of the malloced buffer.

2 - pass in a URL with only a question mark as separator (no slash) between the host and the query part of the URL. This leads to a single zero byte overflow of the malloced buffer.

Both overflows can be made with the same input string, leading to two single zero byte overwrites.

The affected flaw cannot be triggered by a redirect, but the long URL must be passed in 'directly' to libcurl. It makes this a 'local' problem. Of course, lots of programs may still pass in user-provided URLs to libcurl without doing much syntax checking of their own, allowing a user to exploit this vulnerability.

The remote host is running Apple Mac OS X, but lacks Security Update 2006-003. This security update contains fixes for the following applications :
AppKit
ImageIO
BOM
CFNetwork
ClamAV (Mac OS X Server only)
CoreFoundation
CoreGraphics
Finder
FTPServer
Flash Player
KeyChain
LaunchServices
libcurl
Mail
MySQL Manager (Mac OS X Server only)
Preview
QuickDraw
QuickTime Streaming Server
Ruby
Safari

The remote Mac OS X host is running a version of Quicktime prior to 7.1.  The remote version of Quicktime is vulnerable to various integer and buffer overflows involving specially-crafted image and media files.  An attacker may be able to leverage these issues to execute arbitrary code on the remote host by sending a malformed file to a victim and having it opened using QuickTime player.

The remote host is running Apple Mac OS X, but lacks Security Update 2006-003.

This security update contains fixes for the following applications :

AppKit ImageIO BOM CFNetwork ClamAV (Mac OS X Server only) CoreFoundation CoreGraphics Finder FTPServer Flash Player KeyCHain LaunchServices libcurl Mail MySQL Manager (Mac OS X Server only) Preview QuickDraw QuickTime Streaming Server Ruby Safari

The remote host is affected by the vulnerability described in GLSA-200603-25 (OpenOffice.org: Heap overflow in included libcurl)

    OpenOffice.org includes libcurl code. This libcurl code is     vulnerable to a heap overflow when it tries to parse a URL that exceeds     a 256-byte limit (GLSA 200512-09).
  Impact :

    An attacker could entice a user to call a specially crafted URL     with OpenOffice.org, potentially resulting in the execution of     arbitrary code with the rights of the user running the application.
  Workaround :

    There is no known workaround at this time.

Stefan Esser discovered several buffer overflows in the handling of URLs. By attempting to load an URL with a specially crafted invalid hostname, a local attacker could exploit this to execute arbitrary code with the privileges of the application that uses the cURL library.

It is not possible to trick cURL into loading a malicious URL with an HTTP redirect, so this vulnerability was usually not exploitable remotely. However, it could be exploited locally to e. g. circumvent PHP security restrictions.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Stefan Esser discovered that libcurl's URL parser function can have a malloced buffer overflows in two ways if given a too long URL. It cannot be triggered by a redirect, which makes remote exploitation unlikely, but can be passed directly to libcurl (allowing for local exploitation) and could also be used to break out of PHP's safe_mode/ open_basedir.

This vulnerability only exists in libcurl and curl 7.11.2 up to and including 7.15.0, which means that Corporate Server 2.1 and Corporate 3.0 are not vulnerable.

The updated packages have been patched to correct the problem. As well, updated php-curl packages are available that provide a new curl PHP module compiled against the fixed code.

The remote host is affected by the vulnerability described in GLSA-200512-09 (cURL: Off-by-one errors in URL handling)

    Stefan Esser from the Hardened-PHP Project has reported a     vulnerability in cURL that allows for a local buffer overflow when cURL     attempts to parse specially crafted URLs. The URL can be specially     crafted in one of two ways: the URL could be malformed in a way that     prevents a terminating null byte from being added to either a hostname     or path buffer; or the URL could contain a '?' separator in the     hostname portion, which causes a '/' to be prepended to the resulting     string.
  Impact :

    An attacker capable of getting cURL to parse a maliciously crafted     URL could cause a denial of service or execute arbitrary code with the     privileges of the user making the call to cURL. An attacker could also     escape open_basedir or safe_mode pseudo-restrictions when exploiting     this problem from within a PHP program when PHP is compiled with     libcurl.
  Workaround :

    There is no known workaround at this time.

This package fixes a security buffer overflow bug in URL authentication code of curl (CVE-2005-4077).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is using a version of curl (or libcurl) that is vulnerable to a remote buffer overflows. To exploit, an attacker would have to set up a rogue web server and entice a curl user into browsing to the malicious server.  Upon successful exploitation, the attacker would be able to execute arbitrary commands with the rights of the web server.

The remote host is running Apple Mac OS X, but lacks Security Update 2005-009. This security update contains fixes for the following applications :
- Apache2
- Apache_mod_ssl
- CoreFoundation
- curl
- iodbcadmintool
- OpenSSL
- passwordserver
- Safari
- sudo
- syslog 

The remote host is using a version of curl (or libcurl) that is vulnerable to a remote buffer overflows. To exploit, an attacker would have to set up a rogue web server that would reply with a malicious NTLM authentication request.  Upon successful exploitation, the attacker would be able to execute arbitrary commands with the rights of the web server.

The remote host is using a version of wget that contains a flaw in the way that it handles NTLM authentication data.  Specifically, a rogue website that returns malformed data during an NTLM authentication session will be able to execute arbitrary code on the local client machine. 

The remote host is running ClamAV, an antivirus application. There are a number of flaws that affect this version of ClamAV, and the vendor recommends upgrading to version 0.88.1 or higher. 

The remote host is using a version of wget that contains a flaw in the way that it handles NTLM authentication data.  Specifically, a rogue website that returns malformed data during an NTLM authentication session will be able to execute arbitrary code on the local client machine.

The remote host is running Apple Mac OS X, but lacks Security Update 2005-009. This security update contains fixes for the following applications :
- Apache2
- Apache_mod_ssl
- CoreFoundation
- curl
- iodbcadmintool
- OpenSSL
- passwordserver
- Safari
- sudo
- syslog

ID	Name	Product	Family	Severity
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
22785	Debian DSA-919-2 : curl - buffer overflow	Nessus	Debian Local Security Checks	high
21973	CentOS 4 : curl (CESA-2005:875)	Nessus	CentOS Local Security Checks	medium
21483	FreeBSD : curl -- URL buffer overflow vulnerability (9b4facec-6761-11da-99f6-00123ffe8333)	Nessus	FreeBSD Local Security Checks	medium
3617	Mac OS X Multiple Vulnerabilities (Security Update 2006-003)	Nessus Network Monitor	Operating System Detection	medium
3616	Quicktime < 7.1 on Mac OS X Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
21341	Mac OS X Multiple Vulnerabilities (Security Update 2006-003)	Nessus	MacOS X Local Security Checks	critical
21160	GLSA-200603-25 : OpenOffice.org: Heap overflow in included libcurl	Nessus	Gentoo Local Security Checks	medium
20771	Ubuntu 4.10 / 5.04 / 5.10 : curl vulnerability (USN-228-1)	Nessus	Ubuntu Local Security Checks	medium
20455	Mandrake Linux Security Advisory : curl (MDKSA-2005:224)	Nessus	Mandriva Local Security Checks	medium
20364	RHEL 4 : curl (RHSA-2005:875)	Nessus	Red Hat Local Security Checks	medium
20329	GLSA-200512-09 : cURL: Off-by-one errors in URL handling	Nessus	Gentoo Local Security Checks	medium
20289	Fedora Core 4 : curl-7.13.1-4.fc4 (2005-1129)	Nessus	Fedora Local Security Checks	high
3318	Curl < 7.15.1 Multiple Remote Overflows	Nessus Network Monitor	Web Clients	critical
3308	Mac OS X Multiple Vulnerabilities (Security Update 2005-009)	Nessus Network Monitor	Operating System Detection	high
3256	Curl NTLM Buffer Overflow	Nessus Network Monitor	Web Clients	medium
3255	GNU WGet < 1.10.2 Buffer Overflow	Nessus Network Monitor	Web Clients	medium
3505	ClamAV < 0.88.1 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	medium
801390	Curl NTLM Buffer Overflow	Log Correlation Engine	Web Clients	high
801386	Curl <= 7.15.0 Multiple Remote Overflows	Log Correlation Engine	Web Clients	high
801197	Quicktime < 7.1 on Mac OS X Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800982	GNU WGet < 1.10.2 Buffer Overflow	Log Correlation Engine	Web Clients	high
800798	Mac OS X Multiple Vulnerabilities (Security Update 2005-009)	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2005-4077

critical

Tenable Plugins

critical

high

medium

medium

medium

high

critical

medium

medium

medium

medium

medium

high

critical

high

medium

medium

medium

high

high

high

high

high