Heap-based buffer overflow in cURL - CVE-2018-1000120

Vulnerability identifier: #VU11111

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1000120

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow. A remote attacker that can control the paths that curl uses for FTP can create specially crafted path names containing the control characters '%00', trigger memory corruption and execute arbitrary code.

cURL
Debian Linux
Arch Linux
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
Slackware Linux
Junos OS Evolved
Fedora
Oracle Communications Application Session Controller
Dell EMC Unisphere Central
curl (Alpine package)
curl
Dynamic System Analysis (DSA) Preboot
Integrated Management Module II (IMM2) for BladeCenter Systems
Flex System Integrated Management Module (IMM2)
System x Integrated Management Module (IMM2)
Flex System Chassis Management Module (CMM)

Update to version 7.59.0.

curl (Alpine package) - update to 7.59.0-r0
Junos OS Evolved - addressed in versions 21.4R3-S4-EVO, 22.1R3-S4-EVO, 22.3R3-S1-EVO, 22.4R2-S1-EVO, 23.2R1-EVO
Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
Flex System Integrated Management Module (IMM2) - update to 1AOO86D-7.00
System x Integrated Management Module (IMM2) - update to 1AOO86D-7.00
Integrated Management Module II (IMM2) for BladeCenter Systems - update to 1AOO86D-7.00-bc
Flex System Chassis Management Module (CMM) - update to 2pet16d-2.5.13d
Dell EMC Unisphere Central - update to 4.0.8.23220
curl - addressed in versions 7.53.1-16.fc26, 7.55.1-10.fc27, 7.59.0-1.fc28, 7.59.0-2.fc28

• https://curl.haxx.se/docs/adv_2018-9cd6.html

• Multiple vulnerabilities in cURL
• Debian update for curl
• Slackware Linux update for curl
• Arch Linux update for curl
• Arch Linux update for lib32-curl
• Arch Linux update for libcurl-compat
• Arch Linux update for lib32-libcurl-compat
• Arch Linux update for libcurl-gnutls
• Arch Linux update for lib32-libcurl-gnutls
• Gentoo update for cURL
• Amazon Linux AMI update for curl
• Red Hat update for curl and nss-pem
• Red Hat update for curl
• Red Hat Enterprise Linux Server 7.4 update for curl
• Heap-based buffer overflow in curl (Alpine package)
• Multiple vulnerabilities in Dell EMC Unisphere Central
• Junos OS and Junos OS Evolved update for cURL
• Multiple vulnerabilities in IBM Integrated Management Module II (IMM2)
• Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
• Fedora 28 update for curl
• Fedora 28 update for curl
• Fedora 27 update for curl
• Fedora 26 update for curl
• Multiple vulnerabilities in Oracle Communications Application Session Controller