Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.

The remote host is affected by the vulnerability described in GLSA-201401-14 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user or automated process to connect to       a malicious server using cURL, possibly resulting in the remote execution       of arbitrary code or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.x that is prior to version 10.9. The newer version contains multiple security-related fixes for the following components :

  - Application Firewall
  - App Sandbox
  - Bluetooth
  - CFNetwork
  - CFNetwork SSL
  - Console
  - CoreGraphics
  - curl
  - dyld
  - IOKitUser
  - IOSerialFamily
  - Kernel
  - Kext Management
  - LaunchServices
  - Libc
  - Mail Accounts
  - Mail Header Display
  - Mail Networking
  - OpenLDAP
  - perl
  - Power Management
  - python
  - ruby
  - Security
  - Security - Authorization
  - Security - Smart Card Services
  - Screen Lock
  - Screen Sharing Server
  - syslog
  - USB

A stack buffer overflow flaw was found due to the application failing to properly bounds-check user supplied data before copying it into an insufficiently sized buffer. A remote attacker could exploit this issue to execute arbitrary code in the context of the affected application. (CVE-2013-2174)

Affected versions include versions 7.26.0 through 7.28.1.

fix buffer overflow when negotiating SASL DIGEST-MD5 auth (CVE-2013-0249)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that curl incorrectly handled SASL authentication when communicating over POP3, SMTP or IMAP. If a user or automated system were tricked into processing a specially crafted URL, an attacker could cause a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New curl packages are available for Slackware 14.0, and -current to fix a security issue.

ID	Name	Product	Family	Severity
72053	GLSA-201401-14 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
70561	Mac OS X 10.x < 10.9 Multiple Vulnerabilities (BEAST)	Nessus	MacOS X Local Security Checks	high
801393	cURL/libcURL 'Curl_sasl_create_digest_md5_message()' Stack Buffer Overflow Vulnerability	Log Correlation Engine	Web Clients	medium
6901	cURL/libcURL 'Curl_sasl_create_digest_md5_message()' Stack Buffer Overflow	Nessus Network Monitor	Web Clients	high
64869	Fedora 18 : curl-7.27.0-6.fc18 (2013-2098)	Nessus	Fedora Local Security Checks	high
64619	Ubuntu 12.10 : curl vulnerability (USN-1721-1)	Nessus	Ubuntu Local Security Checks	high
64491	Slackware 14.0 / current : curl (SSA:2013-038-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2013-0249

critical

Tenable Plugins

high

high

medium

high

high

high

high