LDAP NULL pointer dereference
=============================

Project curl Security Advisory, March 14th 2018 -
[Permalink](https://curl.haxx.se/docs/adv_2018-97a2.html)

VULNERABILITY
-------------

curl might dereference a near-NULL address when getting an LDAP URL.

The function `ldap_get_attribute_ber()` is called to get attributes, but it
turns out that it can return `LDAP_SUCCESS` and still return a `NULL` pointer
in the result pointer when getting a particularly crafted response. This was a
surprise to us and to the code.

libcurl-using applications that allow LDAP URLs, or that allow redirects to
LDAP URLs could be made to crash by a malicious server.

We are not aware of any exploit of this flaw.

INFO

----
The bug is only present in curl versions built to use OpenLDAP.
This bug was introduced in May 2010 in [this
commit](https://github.com/curl/curl/commit/2e056353b00d09).
The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2018-1000121 to this issue.
CWE-476: NULL Pointer Dereference
AFFECTED VERSIONS
-----------------
- Affected versions: curl 7.21.0 to and including curl 7.58.0
- Not affected versions: curl < 7.21.0 and curl >= 7.59.0
libcurl is used by many applications, but not always advertised as such.
THE SOLUTION
------------
In curl version 7.59.0, curl checks the pointer properly before using it.
A [patch for CVE-2018-1000121](https://curl.haxx.se/CVE-2018-1000121.patch) is available.
RECOMMENDATIONS
---------------
We suggest you take one of the following actions immediately, in order of
preference:
  A - Upgrade curl to version 7.59.0
  B - Apply the patch to your version and rebuild
  C - Make sure you disable LDAP in your transfers
TIME LINE
---------
It was reported to the curl project on March 6, 2018
We contacted distros_at_openwall on March 7, 2018.
curl 7.59.0 was released on March 14 2018, coordinated with the publication of
this advisory.
CREDITS
-------
Reported by Dario Weisser. Patch by Daniel Stenberg.
Thanks a lot!
-- 
  / daniel.haxx.se
-------------------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-library
Etiquette:   https://curl.haxx.se/mail/etiquette.html