CVE-2017-1000101
URL globbing out of bounds read
Project curl Security Advisory, August 9th 2017 - Permalink
VULNERABILITY
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers.
In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing.
An example of a URL that triggers the flaw would be http://ur%20[0-60000000000000000000.
INFO
This flaw only affects the curl command line tool, not the libcurl library.
For version 7.55.0, the parser properly stops at the end of the string and a test has been added to verify this.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2017-1000101 to this issue.
CWE-126: Buffer Over-read
Severity: Medium
AFFECTED VERSIONS
- Affected versions: curl 7.34.0 to and including 7.54.1
- Not affected versions: curl < 7.34.0 and >= 7.55.0
- Introduced-in: https://github.com/curl/curl/commit/5ca96cb84410270
curl is used by many applications, but not always advertised as such.
SOLUTION
RECOMMENDATIONS
We suggest you take one of the following actions immediately, in order of preference:
A - Upgrade curl to version 7.55.0
B - Apply the patch to your version and rebuild
TIMELINE
It was reported to the curl project on June 14, 2017. We contacted distros@openwall on August 1.
curl 7.55.0 was released on August 9 2017, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Brian Carpenter, Yongji Ouyang
- Patched-by: Daniel Stenberg
Thanks a lot!