Bug 1749652 (CVE-2019-5482) - CVE-2019-5482 curl: heap buffer overflow in function tftp_receive_packet()
Summary: CVE-2019-5482 curl: heap buffer overflow in function tftp_receive_packet()
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-5482
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1751926 1751927 1751928 1751929 1751930 1751931 1916662 1916663 1916664
Blocks: 1749416
TreeView+ depends on / blocked
 
Reported: 2019-09-06 07:11 UTC by Dhananjay Arunesh
Modified: 2021-03-30 09:27 UTC (History)
30 users (show)

Fixed In Version: curl 7.66
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-04-28 16:34:11 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:1792 0 None None None 2020-04-28 15:53:18 UTC
Red Hat Product Errata RHSA-2020:3916 0 None None None 2020-09-29 19:48:33 UTC
Red Hat Product Errata RHSA-2021:0759 0 None None None 2021-03-09 09:17:47 UTC
Red Hat Product Errata RHSA-2021:0877 0 None None None 2021-03-16 14:53:05 UTC

Description Dhananjay Arunesh 2019-09-06 07:11:04 UTC
A vulnerability was found in libcurl contains a heap buffer overflow in the function ('tftp_receive_packet()') that receives data from a TFTP server. It can call 'recvfrom()' with the default size for the buffer rather than with the size that was used to allocate it. Thus, the content that might overwrite the heap memory is controlled by the server.

Comment 3 Dhananjay Arunesh 2019-09-09 03:59:52 UTC
Acknowledgments:

Name: the Curl project
Upstream: Thomas Vegas

Comment 4 Kamil Dudka 2019-09-12 13:28:03 UTC
What is the impact and cvss score for this issue?

https://access.redhat.com/security/cve/CVE-2019-5482 gives me 404.

Comment 5 Huzaifa S. Sidhpurwala 2019-09-13 06:34:33 UTC
Upstream patch: https://github.com/curl/curl/commit/facb0e4662415b5f28163e853dc6742ac5fafb3d

This flaw was introduced in January 2009 via https://github.com/curl/curl/commit/0516ce7786e9500c2e44
This flaw only affects libcurl >= 7.19.4 to and including 7.65.3

Comment 6 Huzaifa S. Sidhpurwala 2019-09-13 06:34:36 UTC
External References:

https://curl.haxx.se/docs/CVE-2019-5482.html

Comment 7 Huzaifa S. Sidhpurwala 2019-09-13 06:34:59 UTC
Created curl tracking bugs for this issue:

Affects: fedora-all [bug 1751926]


Created mingw-curl tracking bugs for this issue:

Affects: epel-7 [bug 1751928]
Affects: fedora-all [bug 1751927]

Comment 9 Huzaifa S. Sidhpurwala 2019-09-13 06:40:22 UTC
This is a heap-buffer overflow in libcurl, which can be controlled by the TFTP server. This flaw is only triggered if the TFTP server sends an OACK without the BLKSIZE option, when a BLKSIZE smaller than 512 bytes was requested by the TFTP client. OACK is a TFTP extension and is not used by all TFTP servers.

However using smaller BLKSIZE is rare. It is rare for users to use TFTP across the Internet. It is most commonly used within local networks. TFTP as a protocol is always inherently insecure.

This issue was introduced by the add of the TFTP BLKSIZE option handling. It was previously incompletely fixed by an almost identical issue called CVE-2019-5436.

Comment 10 Huzaifa S. Sidhpurwala 2019-09-13 06:40:25 UTC
Mitigation:

Do not use TFTP with curl with smaller than the default BLKSIZE.

Comment 15 errata-xmlrpc 2020-04-28 15:53:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1792 https://access.redhat.com/errata/RHSA-2020:1792

Comment 16 Product Security DevOps Team 2020-04-28 16:34:11 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-5482

Comment 17 errata-xmlrpc 2020-09-29 19:48:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3916 https://access.redhat.com/errata/RHSA-2020:3916

Comment 19 errata-xmlrpc 2021-03-09 09:17:42 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Advanced Update Support
  Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.4 Telco Extended Update Support

Via RHSA-2021:0759 https://access.redhat.com/errata/RHSA-2021:0759

Comment 20 errata-xmlrpc 2021-03-16 14:53:03 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Extended Update Support

Via RHSA-2021:0877 https://access.redhat.com/errata/RHSA-2021:0877

Comment 21 errata-xmlrpc 2021-03-30 09:27:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Extended Update Support

Via RHSA-2021:1027 https://access.redhat.com/errata/RHSA-2021:1027


Note You need to log in before you can comment on or make changes to this bug.