cnvd - cnvd-2017-35204

cnvd-2017-35204

Vulnerability from cnvd

Title: cURL缓冲区溢出漏洞（CNVD-2017-35204）

Description:

cURL是一个利用URL语法在命令行下工作的文件传输工具。

cURL存在缓冲区溢出漏洞。通过返回特制IMAP FETCH响应，远程用户可触发IMAP处理程序发生缓冲区过读，并从目标系统的内存中获取可能敏感的信息，或者导致使用libcurl的目标应用程序崩溃。

Severity: 中

Patch Name: cURL缓冲区溢出漏洞（CNVD-2017-35204）的补丁

Patch Description:

cURL是一个利用URL语法在命令行下工作的文件传输工具。

cURL存在缓冲区溢出漏洞。通过返回特制IMAP FETCH响应，远程用户可触发IMAP处理程序发生缓冲区过读，并从目标系统的内存中获取可能敏感的信息，或者导致使用libcurl的目标应用程序崩溃。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布漏洞修复程序，请及时关注更新： https://curl.haxx.se/docs/adv_20171023.html

Reference: http://www.securityfocus.com/bid/101519

Impacted products

Name
['cURL cURL >=7.20.0，<=7.56.0', 'Libcurl Libcurl >=7.20.0，<=7.56.0']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "101519"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-1000257"
    }
  },
  "description": "cURL\u662f\u4e00\u4e2a\u5229\u7528URL\u8bed\u6cd5\u5728\u547d\u4ee4\u884c\u4e0b\u5de5\u4f5c\u7684\u6587\u4ef6\u4f20\u8f93\u5de5\u5177\u3002\r\n\r\ncURL\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u901a\u8fc7\u8fd4\u56de\u7279\u5236IMAP FETCH\u54cd\u5e94\uff0c\u8fdc\u7a0b\u7528\u6237\u53ef\u89e6\u53d1IMAP\u5904\u7406\u7a0b\u5e8f\u53d1\u751f\u7f13\u51b2\u533a\u8fc7\u8bfb\uff0c\u5e76\u4ece\u76ee\u6807\u7cfb\u7edf\u7684\u5185\u5b58\u4e2d\u83b7\u53d6\u53ef\u80fd\u654f\u611f\u7684\u4fe1\u606f\uff0c\u6216\u8005\u5bfc\u81f4\u4f7f\u7528libcurl\u7684\u76ee\u6807\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\u3002",
  "discovererName": "Brian Carpenter, Geeknik Labs and 0xd34db347.",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://curl.haxx.se/docs/adv_20171023.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-35204",
  "openTime": "2017-11-27",
  "patchDescription": "cURL\u662f\u4e00\u4e2a\u5229\u7528URL\u8bed\u6cd5\u5728\u547d\u4ee4\u884c\u4e0b\u5de5\u4f5c\u7684\u6587\u4ef6\u4f20\u8f93\u5de5\u5177\u3002\r\n\r\ncURL\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u901a\u8fc7\u8fd4\u56de\u7279\u5236IMAP FETCH\u54cd\u5e94\uff0c\u8fdc\u7a0b\u7528\u6237\u53ef\u89e6\u53d1IMAP\u5904\u7406\u7a0b\u5e8f\u53d1\u751f\u7f13\u51b2\u533a\u8fc7\u8bfb\uff0c\u5e76\u4ece\u76ee\u6807\u7cfb\u7edf\u7684\u5185\u5b58\u4e2d\u83b7\u53d6\u53ef\u80fd\u654f\u611f\u7684\u4fe1\u606f\uff0c\u6216\u8005\u5bfc\u81f4\u4f7f\u7528libcurl\u7684\u76ee\u6807\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "cURL\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2017-35204\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "cURL cURL \u003e=7.20.0\uff0c\u003c=7.56.0",
      "Libcurl Libcurl \u003e=7.20.0\uff0c\u003c=7.56.0"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/101519",
  "serverity": "\u4e2d",
  "submitTime": "2017-10-25",
  "title": "cURL\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2017-35204\uff09"
}

CVE-2017-1000257 (GCVE-0-2017-1000257)

Vulnerability from cvelistv5

Published

2017-10-31 21:00

Modified

2024-08-05 22:00

Severity ?

CWE

Summary

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.

References

▼	URL	Tags
	https://curl.haxx.se/docs/adv_20171023.html	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2017:3263	vendor-advisory, x_refsource_REDHAT
	https://security.gentoo.org/glsa/201712-04	vendor-advisory, x_refsource_GENTOO
	http://www.securitytracker.com/id/1039644	vdb-entry, x_refsource_SECTRACK
	https://access.redhat.com/errata/RHSA-2018:3558	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/101519	vdb-entry, x_refsource_BID
	http://www.debian.org/security/2017/dsa-4007	vendor-advisory, x_refsource_DEBIAN
	https://access.redhat.com/errata/RHSA-2018:2486	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T22:00:39.661Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://curl.haxx.se/docs/adv_20171023.html"
          },
          {
            "name": "RHSA-2017:3263",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:3263"
          },
          {
            "name": "GLSA-201712-04",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201712-04"
          },
          {
            "name": "1039644",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1039644"
          },
          {
            "name": "RHSA-2018:3558",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3558"
          },
          {
            "name": "101519",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/101519"
          },
          {
            "name": "DSA-4007",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-4007"
          },
          {
            "name": "RHSA-2018:2486",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2486"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2017-10-17T00:00:00",
      "datePublic": "2017-10-31T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl\u0027s deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-13T10:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://curl.haxx.se/docs/adv_20171023.html"
        },
        {
          "name": "RHSA-2017:3263",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:3263"
        },
        {
          "name": "GLSA-201712-04",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201712-04"
        },
        {
          "name": "1039644",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1039644"
        },
        {
          "name": "RHSA-2018:3558",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3558"
        },
        {
          "name": "101519",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/101519"
        },
        {
          "name": "DSA-4007",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-4007"
        },
        {
          "name": "RHSA-2018:2486",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2486"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2017-10-17",
          "ID": "CVE-2017-1000257",
          "REQUESTER": "daniel@haxx.se",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl\u0027s deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://curl.haxx.se/docs/adv_20171023.html",
              "refsource": "CONFIRM",
              "url": "https://curl.haxx.se/docs/adv_20171023.html"
            },
            {
              "name": "RHSA-2017:3263",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:3263"
            },
            {
              "name": "GLSA-201712-04",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201712-04"
            },
            {
              "name": "1039644",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1039644"
            },
            {
              "name": "RHSA-2018:3558",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:3558"
            },
            {
              "name": "101519",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/101519"
            },
            {
              "name": "DSA-4007",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-4007"
            },
            {
              "name": "RHSA-2018:2486",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2486"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-1000257",
    "datePublished": "2017-10-31T21:00:00",
    "dateReserved": "2017-10-31T00:00:00",
    "dateUpdated": "2024-08-05T22:00:39.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted