CVE-2017-1000101MEDIUM
Description
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.
References
http://www.debian.org/security/2017/dsa-3992
http://www.securityfocus.com/bid/100249
http://www.securitytracker.com/id/1039117
https://access.redhat.com/errata/RHSA-2018:3558
https://curl.haxx.se/docs/adv_20170809A.html
Details
Source: MITRE
Published: 2017-10-05
Updated: 2018-11-13
Type: CWE-119
Risk Information
CVSS v2.0
Base Score: 4.3
Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Impact Score: 2.9
Exploitability Score: 8.6
Severity: MEDIUM
CVSS v3.0
Base Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Impact Score: 3.6
Exploitability Score: 2.8
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:haxx:curl:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.35.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.36.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.37.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.37.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.38.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.39.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.40.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.41.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.42.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.42.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.43.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.44.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.45.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.46.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.47.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.47.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.48.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.49.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.49.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.50.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.50.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.50.2:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.50.3:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.51.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.52.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.52.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.53.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.53.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.54.0:*:*:*:*:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 700512 | macOS 10.13.x < 10.13.1 Multiple Vulnerabilities | Nessus Network Monitor | Operating System Detection | critical |
| 121761 | Photon OS 2.0: Curl PHSA-2017-0045 | Nessus | PhotonOS Local Security Checks | high |
| 111894 | Photon OS 2.0: Bash / Curl / Go / Libtiff / Systemd PHSA-2017-0045 (deprecated) | Nessus | PhotonOS Local Security Checks | high |
| 104379 | macOS and Mac OS X Multiple Vulnerabilities (Security Update 2017-001 and 2017-004) | Nessus | MacOS X Local Security Checks | critical |
| 104378 | macOS 10.13.x < 10.13.1 Multiple Vulnerabilities | Nessus | MacOS X Local Security Checks | high |
| 103773 | Ubuntu 14.04 LTS / 16.04 LTS / 17.04 : curl vulnerabilities (USN-3441-1) | Nessus | Ubuntu Local Security Checks | medium |
| 103715 | Debian DSA-3992-1 : curl - security update | Nessus | Debian Local Security Checks | medium |
| 103282 | GLSA-201709-14 : cURL: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | medium |
| 102877 | Amazon Linux AMI : curl (ALAS-2017-889) | Nessus | Amazon Linux Local Security Checks | medium |
| 102566 | openSUSE Security Update : curl (openSUSE-2017-951) | Nessus | SuSE Local Security Checks | medium |
| 102540 | SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2017:2174-1) | Nessus | SuSE Local Security Checks | medium |
| 102463 | Fedora 25 : curl (2017-f2df9d7772) | Nessus | Fedora Local Security Checks | medium |
| 102462 | Fedora 26 : curl (2017-f1ffd18079) | Nessus | Fedora Local Security Checks | medium |
| 102365 | Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : curl (SSA:2017-221-01) | Nessus | Slackware Local Security Checks | medium |
| 102330 | FreeBSD : cURL -- multiple vulnerabilities (69cfa386-7cd0-11e7-867f-b499baebfeaf) | Nessus | FreeBSD Local Security Checks | medium |