CVE-2022-32208

FTP-KRB bad message verification

Project curl Security Advisory, June 27th 2022 - Permalink

VULNERABILITY

When curl does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

INFO

CVE-2022-32208 was introduced in commit 54967d2a3a, shipped in curl 7.16.4.

This flaw typically makes curl insert 599 (+ terminating null) into the data where it detects the error, then the attackers data. It forces the attacker to be somewhat creative to handle this initial hard-coded 5 byte sequence of "junk".

FTP-KRB is a rarely used feature.

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Severity: Low

AFFECTED VERSIONS

• Affected versions: curl 7.16.4 to and including 7.83.1
• Not affected versions: curl < 7.16.4 and curl >= 7.84.0
• Introduced-in: https://github.com/curl/curl/commit/54967d2a3a

libcurl is used by many applications, but not always advertised as such!

SOLUTION

• Fixed-in: https://github.com/curl/curl/commit/6ecdf5136b52af7

RECOMMENDATIONS

A - Upgrade curl to version 7.84.0

B - Apply the patch to your local version

C - Do not use KRB-FTP

TIMELINE

This issue was reported to the curl project on June 2, 2022. We contacted distros@openwall on June 20.

libcurl 7.84.0 was released on June 27 2022, coordinated with the publication of this advisory.

CREDITS

• Reported-by: Harry Sintonen
• Patched-by: Daniel Stenberg

Thanks a lot!