Bug 906779 (CVE-2013-0249) - CVE-2013-0249 curl: Stack-based buffer overflow when negotiating SASL DIGEST-MD5 authentication with IMAP, POP3 and SMTP protocols
Summary: CVE-2013-0249 curl: Stack-based buffer overflow when negotiating SASL DIGEST-...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2013-0249
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 908301
Blocks: 906789
TreeView+ depends on / blocked
 
Reported: 2013-02-01 13:29 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:59 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-02-25 08:35:50 UTC


Attachments (Terms of Use)
Proposed upstream patch to correct this issue (2.41 KB, patch)
2013-02-01 13:34 UTC, Jan Lieskovsky
no flags Details | Diff

Description Jan Lieskovsky 2013-02-01 13:29:04 UTC
A stack-based buffer overflow flaw was found in the way SASL implementation of cURL, a command line tool for transferring data with URL syntax, performed DIGEST-MD5 authentication negotiation for IMAP, POP3, and SMTP protocols. A rogue server could use this flaw to cause curl executable / application using the libcurl library it to crash or, potentially, execute arbitrary code with the privileges of the user running the curl binary / the application.

Comment 2 Jan Lieskovsky 2013-02-01 13:34:32 UTC
Created attachment 691585 [details]
Proposed upstream patch to correct this issue

Comment 3 Jan Lieskovsky 2013-02-01 13:36:16 UTC
This issue did not affect the versions of the curl package, as shipped with Red Hat Enterprise Linux 5 and 6.

--

This issue did not affect the versions of the curl package, as shipped with Fedora release of 16 and 17.

--

This issue affects the version of the curl package, as shipped with Fedora release of 18.

Comment 4 Jan Lieskovsky 2013-02-01 13:37:19 UTC
cURL upstream proposes next Wednesday, February the 6-th, 2013, as the embargo date for this issue.

Comment 5 Jan Lieskovsky 2013-02-01 13:40:32 UTC
Acknowledgements:

Red Hat would like to that Daniel Stenberg of cURL project for reporting of this issue. Upstream acknowledges researcher known as Volema as the original issue reporter.

Comment 6 Jan Lieskovsky 2013-02-01 13:43:47 UTC
Statement:

Not vulnerable. This issue did not affect the versions of curl as shipped with Red Hat Enterprise Linux 5 and 6.

Comment 7 Jan Lieskovsky 2013-02-06 11:27:54 UTC
External References:

http://curl.haxx.se/docs/adv_20130206.html

Comment 8 Jan Lieskovsky 2013-02-06 11:29:26 UTC
Created curl tracking bugs for this issue

Affects: fedora-18 [bug 908301]

Comment 9 Tomas Hoger 2013-02-08 09:09:37 UTC
Write up form the reporter of the issue, along with proof-of-concept code:

http://blog.volema.com/curl-rce.html

Comment 10 Fedora Update System 2013-02-24 08:27:05 UTC
curl-7.27.0-6.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.