CVE-2016-7167
curl escape and unescape integer overflows
Project curl Security Advisory, September 14, 2016 - Permalink
VULNERABILITY
The four libcurl functions curl_escape(),
curl_easy_escape(), curl_unescape and
curl_easy_unescape perform string URL percent escaping and
unescaping. They accept custom string length inputs in signed integer
arguments. (The functions having names without "easy" being the
deprecated versions of the others.)
The provided string length arguments were not properly checked and
due to arithmetic in the functions, passing in the length
0xffffffff (2^32-1 or UINT_MAX or even just
-1) would end up causing an allocation of zero bytes of heap memory that
curl would attempt to write gigabytes of data into.
The use of 'int' for this input type in the API is of course unwise but has remained so in order to maintain the API over the years.
INFO
This flaw does not affect the curl command line tool.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2016-7167 to this issue.
CWE-131: Incorrect Calculation of Buffer Size
Severity: Medium
AFFECTED VERSIONS
This flaw exists in the following libcurl versions.
- Affected versions: libcurl 7.11.1 to and including 7.50.2
- Not affected versions: libcurl < 7.11.1 and libcurl >= 7.50.3
libcurl is used by many applications, but not always advertised as such!
SOLUTION
In version 7.50.3, these functions deny negative string lengths from being used.
RECOMMENDATIONS
We suggest you take one of the following actions immediately, in order of preference:
A - Upgrade curl and libcurl to version 7.50.3
B - Apply the patch to your version and rebuild
C - Make sure you do not pass in string lengths larger than
INT_MAX (typically 2^31) or negative values to the
curl_easy_(un)escape() functions!
TIMELINE
It was first reported to the curl project on September 8 based on discussions in PHP bug report 72674.
libcurl 7.50.3 was released on September 14 2016, coordinated with the publication of this advisory.
CREDITS
- Reported-by: the Mitre CVE Assignment Team
- Patched-by: Daniel Stenberg
Thanks a lot!