FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

curl -- URL buffer overflow vulnerability

Affected packages
7.11.2 <= curl < 7.15.1

Details

VuXML ID 9b4facec-6761-11da-99f6-00123ffe8333
Discovery 2005-12-07
Entry 2005-12-09
Modified 2006-01-01

A Project cURL Security Advisory reports:

libcurl's URL parser function can overflow a malloced buffer in two ways, if given a too long URL.

1 - pass in a URL with no protocol (like "http://") prefix, using no slash and the string is 256 bytes or longer. This leads to a single zero byte overflow of the malloced buffer.

2 - pass in a URL with only a question mark as separator (no slash) between the host and the query part of the URL. This leads to a single zero byte overflow of the malloced buffer.

Both overflows can be made with the same input string, leading to two single zero byte overwrites.

The affected flaw cannot be triggered by a redirect, but the long URL must be passed in "directly" to libcurl. It makes this a "local" problem. Of course, lots of programs may still pass in user-provided URLs to libcurl without doing much syntax checking of their own, allowing a user to exploit this vulnerability.

References

Bugtraq ID 15756
CVE Name CVE-2005-4077
URL http://curl.haxx.se/docs/adv_20051207.html
URL http://secunia.com/advisories/17907/
URL http://www.hardened-php.net/advisory_242005.109.html