Win CE schannel cert name out of buffer read
============================================

Project curl Security Advisory, December 21, 2016 -
[Permalink](https://curl.haxx.se/docs/adv_20161221C.html)

VULNERABILITY
-------------

curl's TLS server certificate checks are flawed on Windows CE.

This vulnerability occurs in the verify certificate function when comparing a
wildcard certificate name (as returned by the Windows API function
CertGetNameString) to the hostname used to make the connection to the server.

The pattern matching logic exhibits an out of bounds read. If the wildcard
certificate name field is longer than the connection host name, the wildcard
comparison code will perform a buffer overread of the connection hostname heap
based buffer. This issue could technically leak the contents of memory
immediately preceding the connection hostname buffer, just a crash or at worst
happen to match against another piece of data.

We are not aware of any exploit of this flaw.

INFO

----
This vulnerability only happens on libcurl built for Windows CE using the
schannel TLS backend.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2016-9953 to this issue.
AFFECTED VERSIONS
-----------------
This flaw exists in the following libcurl versions.
- Affected versions: libcurl 7.30.0 to and including 7.51.0
- Not affected versions: libcurl >= 7.52.0
libcurl is used by many applications, but not always advertised as such!
THE SOLUTION
------------
In version 7.52.0, the certificate check is changed to instead use the libcurl
certificate verifying function used for a few other TLS backends that doesn't
contain these flaws.
A [patch for CVE-2016-9953](https://curl.haxx.se/CVE-2016-9952.patch) is
available. The patch is the identical one used for
[CVE-2016-9952](adv_20161221B.html).
RECOMMENDATIONS
---------------
We suggest you take one of the following actions immediately, in order of
preference:
  A - Upgrade curl and libcurl to version 7.52.0
  B - Apply the patch to your version and rebuild
  C - Do not use the schannel backend on Windows CE
TIME LINE
---------
It was first reported to the curl project on November 29 by Dan McNulty.
We contacted MITRE on December 13.
curl 7.52.0 was released on December 21 2016, coordinated with the publication
of this advisory.
CREDITS
-------
Reported and patched by Dan McNulty.
-- 
  / daniel.haxx.se
-------------------------------------------------------------------
List admin: https://cool.haxx.se/list/listinfo/curl-users
FAQ:        https://curl.haxx.se/docs/faq.html
Etiquette:  https://curl.haxx.se/mail/etiquette.html