The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Multiple Vulnerabilities in cURL/libcURL (Kerberos Authentication, NTLM
Authentication)
------------------------------------------------------------------------
SUMMARY
<http://curl.haxx.se/> cURL is "a command line tool for transferring
files with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET,
DICT, FILE and LDAP".
Remote exploitation of a stack-based buffer overflow in various UNIX/Linux
vendors' implementation of cURL could allow for arbitrary code execution
on the targeted host.
DETAILS
Vulnerable Systems:
* cURL version 7.3 up to 7.13.0 inclusive
Immune Systems:
* cURL version 7.13.1 or newer
Kerberos Authentication Buffer Overflow:
An exploitable stack-based buffer overflow condition exists when using
Kerberos authentication. The problem specifically exists within the
functions Curl_krb_kauth() and krb4_auth() defined in lib/krb4.c. Within
these functions a statically allocated stack-based buffer of size 1250,
from struct KTEXT_ST.dat, is passed to the Curl_base64_decode() routine
defined in lib/base64.c:
Code Snips:
len = Curl_base64_decode(p, (char *)adat.dat);
tmp = Curl_base64_decode(p, (char *)tkt.dat);
The Curl_base64_decode() routine relies on the calling function to
validate the decoded length. This function base64 decodes and copies data
directly from the HTTP reply of a server to the destination buffer, in
this case buffer[]. An attacker can construct a long base64 encoded
malicious payload that upon decoding will overflow the static buffer and
overwrite the saved EIP. This in turn can lead to arbitrary code
execution.
NTLM Authentication Buffer Overflow:
An exploitable stack-based buffer overflow condition exists when using NT
Lan Manager (NTLM) authentication. The problem specifically exists within
Curl_input_ntlm() defined in lib/http_ntlm.c. Within this function an
unsigned stack-based character array of size 256, buffer[], is passed to
the Curl_base64_decode() routine defined in lib/base64.c.
Code Snips:
size_t size = Curl_base64_decode(header, (char *)buffer);
The Curl_base64_decode() routine relies on the calling function to
validate the decoded length. This function base64 decodes and copies data
directly from the HTTP reply of a server to the destination buffer, in
this case buffer[]. An attacker can construct a long base64 encoded
malicious payload that upon decoding will overflow the 256 byte static
buffer and overwrite the saved EIP. This in turn can lead to arbitrary
code execution.
Disclosure Timeline:
12/21/2004 - Initial vendor notification - No response
02/10/2005 - Secondary vendor notification - No response
02/21/2005 - Public disclosure
ADDITIONAL INFORMATION
The information has been provided by
<mailto:idlabs-advisories@idefense.com> idlabs.
The original articles can be found at:
<http://www.idefense.com/application/poi/display?id=202&type=vulnerabilities>
http://www.idefense.com/application/poi/display?id=202&type=vulnerabilities and
<http://www.idefense.com/application/poi/display?id=203&type=vulnerabilities>
http://www.idefense.com/application/poi/display?id=203&type=vulnerabilities.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
