[arch-security] [ASA-201708-16] curl: information disclosure

[Santiago Torres-Arias]

Arch Linux Security Advisory ASA-201708-16
==========================================

Severity: Medium
Date    : 2017-08-22
CVE-ID  : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000101
Package : curl
Type    : information disclosure
Remote  : Yes
Link    : https://security.archlinux.org/AVG-370

Summary
=======

The package curl before version 7.55-1 is vulnerable to information
disclosure.

Resolution
==========

Upgrade to 7.55-1.

# pacman -Syu "curl>=7.55-1"

The problems have been fixed upstream in version 7.55.

Workaround
==========

None.

Description
===========

- CVE-2017-1000099 (information disclosure)

An information disclosure issue has been found in curl < 7.55.0. When
asking to get a file from a file:// URL, libcurl provides a feature
that outputs meta-data about the file using HTTP-like headers. The code
doing this would send the wrong buffer to the user (stdout or the
application's provide callback), which could lead to other private data
from the heap to get inadvertently displayed. The wrong buffer was an
uninitialized memory area allocated on the heap and if it turned out to
not contain any zero byte, it would continue and display the data
following that buffer in memory.

- CVE-2017-1000100 (information disclosure)

An information disclosure issue has been found in curl < 7.55.0. When
doing a TFTP transfer and curl/libcurl is given a URL that contains a
very long file name (longer than about 515 bytes), the file name is
truncated to fit within the buffer boundaries, but the buffer size is
still wrongly updated to use the untruncated length. This too large
value is then used in the sendto() call, making curl attempt to send
more data than what is actually put into the buffer. The sendto()
function will then read beyond the end of the heap based buffer.
A malicious HTTP(S) server could redirect a vulnerable libcurl-using
client to a crafted TFTP URL (if the client hasn't restricted which
protocols it allows redirects to) and trick it to send private memory
contents to a remote server over UDP.

- CVE-2017-1000101 (information disclosure)

A heap-based read buffer overflow has been found in curl < 7.55.0. In
the globbing function that parses the numerical range, there was an
omission that made curl read a byte beyond the end of the URL if given
a carefully crafted, or just wrongly written, URL. The URL is stored in
a heap based buffer, so it could then be made to wrongly read something
else instead of crashing. An example of a URL that triggers the flaw
would be http://ur%20[0-60000000000000000000. This flaw only affects
the curl command line tool, not the libcurl library.

Impact
======

An attacker is able to read sensitive information by asking curl to
retrieve a maliciously crafted URL.

References
==========

https://curl.haxx.se/docs/adv_20170809C.html
https://curl.haxx.se/CVE-2017-1000099.patch
https://curl.haxx.se/docs/adv_20170809B.html
https://curl.haxx.se/CVE-2017-1000100.patch
https://curl.haxx.se/docs/adv_20170809A.html
https://curl.haxx.se/CVE-2017-1000101.patch
https://security.archlinux.org/CVE-2017-1000099
https://security.archlinux.org/CVE-2017-1000100
https://security.archlinux.org/CVE-2017-1000101
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20170822/ae391360/attachment.asc>