An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.

The remote NewStart CGSL host, running version MAIN 5.04, has curl packages installed that are affected by a vulnerability:

  - A buffer overrun flaw was found in the IMAP handler of     libcurl. By tricking an unsuspecting user into     connecting to a malicious IMAP server, an attacker could     exploit this flaw to potentially cause information     disclosure or crash the application. (CVE-2017-1000257)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A NULL pointer dereference flaw was found in the way     libcurl checks values returned by the openldap     ldap_get_attribute_ber() function. A malicious LDAP     server could use this flaw to crash a libcurl client     application via a specially crafted LDAP     reply.(CVE-2018-1000121)

  - It was found that libcurl did not safely parse FTP URLs     when using the CURLOPT_FTP_FILEMETHOD method. An     attacker, able to provide a specially crafted FTP URL     to an application using libcurl, could write a NULL     byte at an arbitrary location, resulting in a crash, or     an unspecified behavior.(CVE-2018-1000120)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8623)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8622)

  - It was found that the libcurl library did not prevent     TLS session resumption when the client certificate had     changed. An attacker could potentially use this flaw to     hijack the authentication of the connection by     leveraging a previously created connection with a     different client certificate.(CVE-2016-5419)

  - A buffer overrun flaw was found in the IMAP handler of     libcurl. By tricking an unsuspecting user into     connecting to a malicious IMAP server, an attacker     could exploit this flaw to potentially cause     information disclosure or crash the     application.(CVE-2017-1000257)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8624)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8621)

  - A buffer over-read exists in curl 7.20.0 to and     including curl 7.58.0 in the RTSP+RTP handling code     that allows an attacker to cause a denial of service or     information leakage(CVE-2018-1000122)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-9586)

  - The FTP wildcard function in curl and libcurl before     7.57.0 allows remote attackers to cause a denial of     service (out-of-bounds read and application crash) or     possibly have unspecified other impact via a string     that ends with an '' character.(CVE-2017-8817)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8618)

  - It was found that the libcurl library using the NSS     (Network Security Services) library as TLS/SSL backend     incorrectly re-used client certificates for subsequent     TLS connections in certain cases. An attacker could     potentially use this flaw to hijack the authentication     of the connection by leveraging a previously created     connection with a different client     certificate.(CVE-2016-7141)

  - cURL and libcurl 7.10.6 through 7.34.0, when more than     one authentication method is enabled, re-uses NTLM     connections, which might allow context-dependent     attackers to authenticate as other users via a     request.(CVE-2014-0015)

  - The tailMatch function in cookie.c in cURL and libcurl     before 7.30.0 does not properly match the path domain     when sending cookies, which allows remote attackers to     steal cookies via a matching suffix in the domain of a     URL.(CVE-2013-1944)

  - It was discovered that the libcurl library failed to     properly handle URLs with embedded end-of-line     characters. An attacker able to make an application     using libcurl access a specially crafted URL via an     HTTP proxy could use this flaw to inject additional     headers to the request or construct additional     requests.(CVE-2014-8150)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8615)

  - The default configuration in cURL and libcurl 7.10.6     before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4)     POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9)     LDAP, and (10) LDAPS connections, which might allow     context-dependent attackers to connect as other users     via a request, a similar issue to     CVE-2014-0015.(CVE-2014-0138)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8617)

  - It was found that the libcurl library did not correctly     handle partial literal IP addresses when parsing     received HTTP cookies. An attacker able to trick a user     into connecting to a malicious server could use this     flaw to set the user's cookie to a crafted domain,     making other cookie-related issues easier to     exploit.(CVE-2014-3613)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - curl before version 7.61.1 is vulnerable to a buffer     overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the     length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap.
    The length value is then subsequently used to iterate     over the password and generate output into the     allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer     overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very     small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer     end up in a heap buffer overflow. (This bug is almost     identical to CVE-2017-8816.)(CVE-2018-14618)

  - It was found that libcurl did not safely parse FTP URLs     when using the CURLOPT_FTP_FILEMETHOD method. An     attacker, able to provide a specially crafted FTP URL     to an application using libcurl, could write a NULL     byte at an arbitrary location, resulting in a crash, or     an unspecified behavior.(CVE-2018-1000120)

  - A NULL pointer dereference flaw was found in the way     libcurl checks values returned by the openldap     ldap_get_attribute_ber() function. A malicious LDAP     server could use this flaw to crash a libcurl client     application via a specially crafted LDAP     reply.(CVE-2018-1000121)

  - A buffer over-read exists in curl 7.20.0 to and     including curl 7.58.0 in the RTSP+RTP handling code     that allows an attacker to cause a denial of service or     information leakage.(CVE-2018-1000122)

  - curl version curl 7.20.0 to and including curl 7.59.0     contains a CWE-126: Buffer Over-read vulnerability in     denial of service that can result in curl can be     tricked into reading data beyond the end of a heap     based buffer used to store downloaded RTSP content..
    (CVE-2018-1000301)

  - A buffer overrun flaw was found in the IMAP handler of     libcurl. By tricking an unsuspecting user into     connecting to a malicious IMAP server, an attacker     could exploit this flaw to potentially cause     information disclosure or crash the     application.(CVE-2017-1000257)

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external entities.
    (CVE-2018-1000007)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libcurl is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.(CVE-2018-16890)

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.(CVE-2017-8816)

curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library.(CVE-2017-8818)

libcurl may read outside of a heap allocated buffer when doing FTP.
When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.(CVE-2017-1000254)

Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.(CVE-2018-16842)

libcurl is vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data.
The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.(CVE-2019-3822)

libcurl is vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.(CVE-2019-3823)

The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.(CVE-2017-8817)

set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.(CVE-2018-20483)

A buffer overrun flaw was found in the IMAP handler of libcurl. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the application.(CVE-2017-1000257)

A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.(CVE-2018-16840)

Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.(CVE-2018-16839)

An update of the curl package has been released.

According to the version of the curl package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A buffer overrun flaw was found in the IMAP handler of     libcurl. By tricking an unsuspecting user into     connecting to a malicious IMAP server, an attacker     could exploit this flaw to potentially cause     information disclosure or crash the     application.(CVE-2017-1000257)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- fix buffer overflow while processing IMAP FETCH response     (CVE-2017-1000257)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201712-04 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause a Denial of Service condition, disclose       sensitive information or other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A buffer overrun flaw was found in the IMAP handler of     libcurl. By tricking an unsuspecting user into     connecting to a malicious IMAP server, an attacker     could exploit this flaw to potentially cause     information disclosure or crash the     application.(CVE-2017-1000257)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for curl is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es) :

* A buffer overrun flaw was found in the IMAP handler of libcurl. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the application. (CVE-2017-1000257)

Red Hat would like to thank the Curl project for reporting this issue.
Upstream acknowledges Brian Carpenter and the OSS-Fuzz project as the original reporters.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - A buffer overrun flaw was found in the IMAP handler of     libcurl. By tricking an unsuspecting user into     connecting to a malicious IMAP server, an attacker could     exploit this flaw to potentially cause information     disclosure or crash the application. (CVE-2017-1000257)

An update for curl is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es) :

* A buffer overrun flaw was found in the IMAP handler of libcurl. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the application. (CVE-2017-1000257)

Red Hat would like to thank the Curl project for reporting this issue.
Upstream acknowledges Brian Carpenter and the OSS-Fuzz project as the original reporters.

From Red Hat Security Advisory 2017:3263 :

An update for curl is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es) :

* A buffer overrun flaw was found in the IMAP handler of libcurl. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the application. (CVE-2017-1000257)

Red Hat would like to thank the Curl project for reporting this issue.
Upstream acknowledges Brian Carpenter and the OSS-Fuzz project as the original reporters.

IMAP FETCH response out of bounds read :

A buffer overrun flaw was found in the IMAP handler of libcurl. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the application. (CVE-2017-1000257)

This update for curl fixes the following issues :

Security issues fixed :

  - CVE-2017-1000254: FTP PWD response parser out of bounds     read (bsc#1061876)

  - CVE-2017-1000257: IMAP FETCH response out of bounds read     (bsc#1063824)

Bugs fixed :

  - Fixed error 'error:1408F10B:SSL routines' when     connecting to ftps via proxy (bsc#1060653)

This update was imported from the SUSE:SLE-12:Update update project.

Brian Carpenter, Geeknik Labs and 0xd34db347 discovered that cURL, an URL transfer library, incorrectly parsed an IMAP FETCH response with size 0, leading to an out-of-bounds read.

Brian Carpenter, Geeknik Labs, 0xd34db347, and independently reported by the OSS-Fuzz project, detected a out of bounds read during IMAP FETCH response.

For Debian 7 'Wheezy', this problem has been fixed in version 7.26.0-1+wheezy22.

We recommend that you upgrade your curl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Brian Carpenter discovered that curl incorrectly handled IMAP FETCH response lines. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl fixes the following issues: Security issues fixed :

  - CVE-2017-1000254: FTP PWD response parser out of bounds     read (bsc#1061876)

  - CVE-2017-1000257: IMAP FETCH response out of bounds read     (bsc#1063824) Bugs fixed :

  - Fixed error 'error:1408F10B:SSL routines' when     connecting to ftps via proxy (bsc#1060653)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The cURL project reports :

libcurl contains a buffer overrun flaw in the IMAP handler. An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.

New curl packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix a security issue.

ID	Name	Product	Family	Severity
127142	NewStart CGSL MAIN 5.04 : curl Vulnerability (NS-SA-2019-0002)	Nessus	NewStart CGSL Local Security Checks	critical
125002	EulerOS Virtualization 3.0.1.0 : curl (EulerOS-SA-2019-1549)	Nessus	Huawei Local Security Checks	critical
124993	EulerOS Virtualization for ARM 64 3.0.1.0 : curl (EulerOS-SA-2019-1540)	Nessus	Huawei Local Security Checks	critical
122260	Amazon Linux 2 : curl (ALAS-2019-1162)	Nessus	Amazon Linux Local Security Checks	critical
121768	Photon OS 2.0: Curl PHSA-2017-0050	Nessus	PhotonOS Local Security Checks	critical
117546	EulerOS Virtualization 2.5.0 : curl (EulerOS-SA-2018-1237)	Nessus	Huawei Local Security Checks	critical
105957	Fedora 27 : curl (2017-b25c8a7087)	Nessus	Fedora Local Security Checks	critical
105264	GLSA-201712-04 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
104931	EulerOS 2.0 SP2 : curl (EulerOS-SA-2017-1313)	Nessus	Huawei Local Security Checks	critical
104930	EulerOS 2.0 SP1 : curl (EulerOS-SA-2017-1312)	Nessus	Huawei Local Security Checks	critical
104816	Virtuozzo 7 : curl / libcurl / libcurl-devel (VZLSA-2017-3263)	Nessus	Virtuozzo Local Security Checks	critical
104803	Scientific Linux Security Update : curl on SL7.x x86_64 (20171127)	Nessus	Scientific Linux Local Security Checks	critical
104801	RHEL 7 : curl (RHSA-2017:3263)	Nessus	Red Hat Local Security Checks	critical
104799	Oracle Linux 7 : curl (ELSA-2017-3263)	Nessus	Oracle Linux Local Security Checks	critical
104790	CentOS 7 : curl (CESA-2017:3263)	Nessus	CentOS Local Security Checks	critical
104704	Amazon Linux AMI : curl (ALAS-2017-922)	Nessus	Amazon Linux Local Security Checks	critical
104316	Fedora 26 : curl (2017-ebf32659bf)	Nessus	Fedora Local Security Checks	critical
104236	openSUSE Security Update : curl (openSUSE-2017-1200)	Nessus	SuSE Local Security Checks	critical
104222	Debian DSA-4007-1 : curl - security update	Nessus	Debian Local Security Checks	critical
104133	Debian DLA-1143-1 : curl security update	Nessus	Debian Local Security Checks	critical
104118	Ubuntu 14.04 LTS / 16.04 LTS : curl vulnerability (USN-3457-1)	Nessus	Ubuntu Local Security Checks	critical
104117	SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2017:2831-1)	Nessus	SuSE Local Security Checks	critical
104113	FreeBSD : cURL -- out of bounds read (143ec3d6-b7cf-11e7-ac58-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	critical
104105	Slackware 14.0 / 14.1 / 14.2 / current : curl (SSA:2017-297-01)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2017-1000257

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical