Docs Overview
Project
Bug Bounty Bug Report Code of conduct Dependencies Donate FAQ Features Governance History Install Known Bugs Logo TODO website Info
Protocols
CA Extract HTTP cookies HTTP/3 MQTT SSL certs SSL libs compared URL syntax WebSocket
Releases
Changelog curl CVEs Release Table Version Numbering Vulnerabilities
Tool
Comparison Table curl man page HTTP Scripting mk-ca-bundle Tutorial When options were added
Who and Why
Companies Copyright Sponsors Thanks The name
curl / Docs / curl CVEs / --write-out out of buffer read
Related:
Audits
Bug Bounty
Changelog
curl CVEs
JSON metadata
Vulnerability Disclosure
Vulnerabilities Table

CVE-2017-7407

--write-out out of buffer read

Project curl Security Advisory, April 3, 2017 - Permalink

VULNERABILITY

There were two bugs in curl's parser for the command line option --write-out (or -w for short) that would skip the end of string zero byte if the string ended in a % (percent) or \ (backslash), and it would read beyond that buffer in the heap memory and it could then potentially output pieces of that memory to the terminal or the target file etc.

The curl security team did not report this as a security vulnerability due to the minimal risk: the memory this would output comes from the process the user itself invokes and that runs with the same privileges as the user. We could not come up with a likely scenario where this could leak other users' data or memory contents.

An external party registered this as a CVE with MITRE and we feel a responsibility to clarify what this flaw is about. The CVE-2017-7407 issue is specifically only about the % part of this flaw.

This flaw only exists in the command line tool.

INFO

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2017-7407 to this issue.

CWE-126: Buffer Over-read

Severity: Medium

AFFECTED VERSIONS

curl has supported this option since version 6.5 (released March 13, 2000).

This flaw exists in the following curl versions.

SOLUTION

In version 7.54.0, the end of the buffer is properly acknowledged and we have added tests that verify this functionality.

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade curl and libcurl to version 7.54.0

B - Apply the patch to your version and rebuild

C - Do not use the --write-out feature with unchecked input

TIMELINE

It was first reported to the curl project on March 10. The MITRE CVE registration was on April 4, 2017. The first commit to fix this was made public on March 11.

curl 7.54.0 is to be released on April 19 2017

CREDITS

Thanks a lot!