Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 109123

Summary: net-misc/curl: buffer overflow vulnerability
Product: Gentoo Security Reporter: Carsten Lohrke (RETIRED) <carlo>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: normal CC: liquidx
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
Package list:
Runtime testing required: ---

Description Carsten Lohrke (RETIRED) gentoo-dev 2005-10-13 05:31:14 UTC
Remote exploitation of a buffer overflow vulnerability in multiple 
vendor's implementations of curl and wget allows attackers to execute 
arbitrary code. 

The vulnerability specifically exists due to insufficent bounds 
checking on user-supplied data supplied to a memory copy operation. The 
memcpy() of the supplied ntlm username to ntlmbuf shown below results 
in a stack overflow:

http-ntlm.c in ntlm_output() on line 532:

    /* size is now 64 */

    memcpy(&amp;ntlmbuf[size], domain, domlen);
    size += domlen;

    memcpy(&amp;ntlmbuf[size], usr, userlen);
    size += userlen;

The resulting stack overflow can be leveraged to gain arbitrary code 
execution with user privileges.
Comment 1 Tavis Ormandy (RETIRED) gentoo-dev 2005-10-13 05:35:07 UTC

*** This bug has been marked as a duplicate of 109097 ***