Bug 1515757 (CVE-2017-8816) - CVE-2017-8816 curl: NTLM buffer overflow via integer overflow
Summary: CVE-2017-8816 curl: NTLM buffer overflow via integer overflow
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2017-8816
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1518620 1518621 1518622 1526300
Blocks: 1515763
TreeView+ depends on / blocked
 
Reported: 2017-11-21 10:27 UTC by Adam Mariš
Modified: 2021-03-11 16:21 UTC (History)
19 users (show)

Fixed In Version: curl 7.57.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-01-03 15:44:47 UTC


Attachments (Terms of Use)
Upstream patch (3.58 KB, patch)
2017-11-21 10:29 UTC, Adam Mariš
no flags Details | Diff
Upstream patch (1.93 KB, patch)
2017-11-21 10:43 UTC, Adam Mariš
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:3558 0 None None None 2018-11-13 08:35:09 UTC

Description Adam Mariš 2017-11-21 10:27:21 UTC
libcurl contains a buffer overrun flaw in the NTLM authentication code.

The internal function `Curl_ntlm_core_mk_ntlmv2_hash` sums up the lengths of
the user name + password (= SUM) and multiplies the sum by two (= SIZE) to
figure out how large storage to allocate from the heap.

The SUM value is subsequently used to iterate over the input and generate
output into the storage buffer. On systems with a 32 bit `size_t`, the math to
calculate SIZE triggers an integer overflow when the combined lengths of the
user name and password is larger than 2GB (2^31 bytes). This integer overflow
usually causes a very small buffer to actually get allocated instead of the
intended very huge one, making the use of that buffer end up in a buffer
overrun.

This is only an issue on 32 bit systems. It also requires the user and
password fields to use more than 2GB of memory combined, which in itself
should be rare.

- Affected versions: libcurl 7.36.0 to and including 7.56.1
- Not affected versions: libcurl < 7.36.0 and >= 7.57.0

Comment 1 Adam Mariš 2017-11-21 10:27:26 UTC
Acknowledgments:

Name: the Curl project
Upstream: Alex Nichols

Comment 3 Adam Mariš 2017-11-21 10:29:50 UTC
Created attachment 1356597 [details]
Upstream patch

Comment 4 Adam Mariš 2017-11-21 10:43:03 UTC
Created attachment 1356599 [details]
Upstream patch

Comment 5 Adam Mariš 2017-11-28 13:57:09 UTC
Issue was introduced by commit:

https://github.com/curl/curl/commit/86724581b6c02d160b52f817550cfdfc9c93af62

Comment 6 Adam Mariš 2017-11-29 10:51:07 UTC
External References:

https://curl.haxx.se/docs/adv_2017-12e7.html

Comment 7 Adam Mariš 2017-11-29 10:52:12 UTC
Created curl tracking bugs for this issue:

Affects: fedora-all [bug 1518621]


Created mingw-curl tracking bugs for this issue:

Affects: epel-7 [bug 1518622]
Affects: fedora-all [bug 1518620]

Comment 11 errata-xmlrpc 2018-11-13 08:35:00 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2018:3558 https://access.redhat.com/errata/RHSA-2018:3558


Note You need to log in before you can comment on or make changes to this bug.