109123 – net-misc/curl: buffer overflow vulnerability

Bug 109123 - net-misc/curl: buffer overflow vulnerability

Summary: net-misc/curl: buffer overflow vulnerability

Status:	RESOLVED DUPLICATE of bug 109097

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	High normal (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2005-10-13 05:31 UTC by Carsten Lohrke (RETIRED)
Modified:	2005-10-13 05:35 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Carsten Lohrke (RETIRED) gentoo-dev

2005-10-13 05:31:14 UTC

Remote exploitation of a buffer overflow vulnerability in multiple 
vendor's implementations of curl and wget allows attackers to execute 
arbitrary code. 

The vulnerability specifically exists due to insufficent bounds 
checking on user-supplied data supplied to a memory copy operation. The 
memcpy() of the supplied ntlm username to ntlmbuf shown below results 
in a stack overflow:

http-ntlm.c in ntlm_output() on line 532:

    /* size is now 64 */
    size=64;
    ntlmbuf[62]=ntlmbuf[63]=0;

    memcpy(&amp;ntlmbuf[size], domain, domlen);
    size += domlen;

    memcpy(&amp;ntlmbuf[size], usr, userlen);
    size += userlen;

The resulting stack overflow can be leveraged to gain arbitrary code 
execution with user privileges.


http://www.mail-archive.com/wget%40sunsite.dk/msg08294.html

Comment 1 Tavis Ormandy (RETIRED) gentoo-dev

2005-10-13 05:35:07 UTC


*** This bug has been marked as a duplicate of 109097 ***