libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.
http://www.debian.org/security/2017/dsa-3992
http://www.securityfocus.com/bid/101115
http://www.securitytracker.com/id/1039509
https://access.redhat.com/errata/RHSA-2018:2486
https://access.redhat.com/errata/RHSA-2018:3558
https://curl.haxx.se/673d0cd8.patch
https://curl.haxx.se/docs/adv_20171004.html
Source: MITRE
Published: 2017-10-06
Updated: 2018-11-13
Type: CWE-119
Base Score: 5
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Impact Score: 2.9
Exploitability Score: 10
Severity: MEDIUM
Base Score: 7.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Impact Score: 3.6
Exploitability Score: 3.9
Severity: HIGH
OR
cpe:2.3:a:haxx:libcurl:7.7:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.7.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.7.2:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.7.3:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.8:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.8.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.9:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.9.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.9.2:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.9.3:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.9.4:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.9.5:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.9.6:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.9.7:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.9.8:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.10:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.10.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.10.2:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.10.3:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.10.4:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.10.5:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.10.6:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.10.7:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.10.8:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.11.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.11.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.11.2:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.12.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.12.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.12.2:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.12.3:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.13.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.13.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.13.2:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.14.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.14.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.15.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.15.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.15.2:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.15.3:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.15.4:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.15.5:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.16.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.16.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.16.2:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.16.3:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.16.4:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.17.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.17.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.18.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.18.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.18.2:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.19.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.19.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.19.2:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.19.3:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.19.4:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.19.5:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.19.6:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.19.7:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.20.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.20.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.21.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.21.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.21.2:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.21.3:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.21.4:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.21.5:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.21.6:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.21.7:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.22.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.23.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.23.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.24.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.25.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.26.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.27.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.28.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.28.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.29.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.30.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.31.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.32.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.33.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.34.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.35.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.36.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.37.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.37.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.38.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.39:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.40.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.41.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.42.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.42.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.43.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.44.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.45.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.46.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.47.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.47.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.48.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.49.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.49.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.50.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.50.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.50.2:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.50.3:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.51.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.52.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.52.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.53.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.53.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.54.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.54.1:*:*:*:*:*:*:*
ID | Name | Product | Family | Severity |
---|---|---|---|---|
125003 | EulerOS Virtualization 3.0.1.0 : curl (EulerOS-SA-2019-1550) | Nessus | Huawei Local Security Checks | high |
700513 | macOS 10.13.x < 10.13.2 Multiple Vulnerabilities (Meltdown) | Nessus Network Monitor | Operating System Detection | critical |
122260 | Amazon Linux 2 : curl (ALAS-2019-1162) | Nessus | Amazon Linux Local Security Checks | high |
121761 | Photon OS 2.0: Curl PHSA-2017-0045 | Nessus | PhotonOS Local Security Checks | high |
121756 | Photon OS 1.0: Curl PHSA-2017-0044 | Nessus | PhotonOS Local Security Checks | medium |
118418 | EulerOS Virtualization 2.5.0 : curl (EulerOS-SA-2018-1330) | Nessus | Huawei Local Security Checks | high |
111894 | Photon OS 2.0: Bash / Curl / Go / Libtiff / Systemd PHSA-2017-0045 (deprecated) | Nessus | PhotonOS Local Security Checks | high |
111893 | Photon OS 1.0: Bash / Curl / Mariadb / Openvswitch / Systemd PHSA-2017-0044 (deprecated) | Nessus | PhotonOS Local Security Checks | medium |
105992 | Fedora 27 : curl (2017-e8179c06fd) | Nessus | Fedora Local Security Checks | medium |
105264 | GLSA-201712-04 : cURL: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | high |
105081 | macOS and Mac OS X Multiple Vulnerabilities (Security Update 2017-002 and 2017-005) | Nessus | MacOS X Local Security Checks | high |
105080 | macOS 10.13.x < 10.13.2 Multiple Vulnerabilities (Meltdown) | Nessus | MacOS X Local Security Checks | high |
104991 | SUSE SLES11 Security Update : curl (SUSE-SU-2017:3176-1) | Nessus | SuSE Local Security Checks | medium |
104907 | EulerOS 2.0 SP2 : curl (EulerOS-SA-2017-1288) | Nessus | Huawei Local Security Checks | medium |
104906 | EulerOS 2.0 SP1 : curl (EulerOS-SA-2017-1287) | Nessus | Huawei Local Security Checks | medium |
104393 | Amazon Linux AMI : curl (ALAS-2017-919) | Nessus | Amazon Linux Local Security Checks | medium |
104236 | openSUSE Security Update : curl (openSUSE-2017-1200) | Nessus | SuSE Local Security Checks | medium |
104117 | SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2017:2831-1) | Nessus | SuSE Local Security Checks | medium |
103895 | Fedora 26 : curl (2017-601b4c20a4) | Nessus | Fedora Local Security Checks | medium |
103773 | Ubuntu 14.04 LTS / 16.04 LTS / 17.04 : curl vulnerabilities (USN-3441-1) | Nessus | Ubuntu Local Security Checks | medium |
103715 | Debian DSA-3992-1 : curl - security update | Nessus | Debian Local Security Checks | medium |
103703 | Slackware 14.0 / 14.1 / 14.2 / current : curl (SSA:2017-279-01) | Nessus | Slackware Local Security Checks | medium |
103682 | Debian DLA-1121-1 : curl security update | Nessus | Debian Local Security Checks | medium |
103666 | FreeBSD : cURL -- out of bounds read (ccace707-a8d8-11e7-ac58-b499baebfeaf) | Nessus | FreeBSD Local Security Checks | medium |