libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for the '\0' terminator one byte too late.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for
    the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because
    strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends
    prematurely. If it does, the for-loop condition checks for the '\0' terminator one byte too late.
    (CVE-2021-36159)

The passive mode in FTP communication allows an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for *p == '\0' one byte too late because p++ was already performed. Impact : The connection buffer size can be controlled by a malicious FTP server because the size is increased until a newline is encountered (or no more characters are read). This also allows to move the buffer into more interesting areas within the address space, potentially parsing relevant numbers for the attacker.
Since these bytes become available to the server in form of a new TCP connection to a constructed port number or even part of the IPv6 address this is a potential information leak.

ID	Name	Product	Family	Severity
423668	Alpine: multiple apk-tools packages, multiple libapk2 packages: security update to 2.12.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
423668	Alpine: multiple apk-tools packages, multiple libapk2 packages: security update to 2.12.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
403558	Alpine: apk-tools: security update to 2.10.7-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
403558	Alpine: apk-tools: security update to 2.10.7-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
400169	Alpine: multiple apk-tools packages, lua5.3-apk: security update to 2.12.5-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
400169	Alpine: multiple apk-tools packages, lua5.3-apk: security update to 2.12.5-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
152857	FreeBSD : FreeBSD -- libfetch out of bounds read (d22b336d-0567-11ec-b69d-4062311215d5)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2021-36159

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical