Bug 1495541 (CVE-2017-1000254) - CVE-2017-1000254 curl: FTP PWD response parser out of bounds read
Summary: CVE-2017-1000254 curl: FTP PWD response parser out of bounds read
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-1000254
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1498395 1498396 1498397
Blocks: 1495542
TreeView+ depends on / blocked
 
Reported: 2017-09-26 09:31 UTC by Andrej Nemec
Modified: 2021-02-17 01:27 UTC (History)
37 users (show)

Fixed In Version: curl 7.56.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-08 03:26:14 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2486 0 None None None 2018-08-16 16:09:24 UTC
Red Hat Product Errata RHSA-2018:3558 0 None None None 2018-11-13 08:34:46 UTC

Description Andrej Nemec 2017-09-26 09:31:46 UTC
When libcurl connects to an FTP server and successfully logs in (anonymous or
not), it asks the server for the current directory with the `PWD` command. The
server then responds with a 257 response containing the path, inside double
quotes. The returned path name is then kept by libcurl for subsequent uses.

Due to a flaw in the string parser for this directory name, a directory name
passed like this but without a closing double quote would lead to libcurl not
adding a trailing NUL byte to the buffer holding the name. When libcurl would
then later access the string, it could read beyond the allocated heap buffer
and crash or wrongly access data beyond the buffer, thinking it was part of
the path.

A malicious server could abuse this fact and effectively prevent libcurl-based
clients to work with it - the PWD command is always issued on new FTP
connections and the mistake has a high chance of causing a segfault.

Introduced with:

https://github.com/curl/curl/commit/415d2e7cb7

External References:

https://curl.haxx.se/docs/adv_20171004.html

Comment 1 Andrej Nemec 2017-09-26 09:31:59 UTC
Acknowledgments:

Name: the Curl project
Upstream: Max Dymond

Comment 3 Andrej Nemec 2017-10-04 08:41:54 UTC
Created curl tracking bugs for this issue:

Affects: fedora-all [bug 1498396]


Created mingw-curl tracking bugs for this issue:

Affects: epel-7 [bug 1498397]
Affects: fedora-all [bug 1498395]

Comment 5 errata-xmlrpc 2018-08-16 16:09:06 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2018:2486 https://access.redhat.com/errata/RHSA-2018:2486

Comment 6 errata-xmlrpc 2018-11-13 08:34:33 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2018:3558 https://access.redhat.com/errata/RHSA-2018:3558


Note You need to log in before you can comment on or make changes to this bug.