CVE-2018-1000121

LDAP NULL pointer dereference

Project curl Security Advisory, March 14th 2018 - Permalink

VULNERABILITY

curl might dereference a near-NULL address when getting an LDAP URL.

The function ldap_get_attribute_ber() is called to get attributes, but it turns out that it can return LDAP_SUCCESS and still return a NULL pointer in the result pointer when getting a particularly crafted response. This was a surprise to us and to the code.

libcurl-using applications that allow LDAP URLs, or that allow redirects to LDAP URLs could be made to crash by a malicious server.

INFO

The bug is only present in curl versions built to use OpenLDAP.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2018-1000121 to this issue.

CWE-476: NULL Pointer Dereference

Severity: Low

AFFECTED VERSIONS

• Affected versions: curl 7.21.0 to and including curl 7.58.0
• Not affected versions: curl < 7.21.0 and curl >= 7.59.0
• Introduced-in: https://github.com/curl/curl/commit/2e056353b00d09

libcurl is used by many applications, but not always advertised as such.

SOLUTION

In curl version 7.59.0, curl checks the pointer properly before using it.

• Fixed-in: https://github.com/curl/curl/commit/9889db043393092e9d4b5a42720

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade curl to version 7.59.0

B - Apply the patch to your version and rebuild

C - Make sure you disable LDAP in your transfers

TIMELINE

It was reported to the curl project on March 6, 2018

We contacted distros@openwall on March 7, 2018.

curl 7.59.0 was released on March 14 2018, coordinated with the publication of this advisory.

CREDITS

• Reported-by: Dario Weisser
• Patched-by: Daniel Stenberg

Thanks a lot!