URL redirection in libcurl - CVE-2016-8624

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU1144

URL redirection in libcurl - CVE-2016-8624

Published: November 3, 2016 / Updated: November 4, 2016


Vulnerability identifier: #VU1144
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-8624
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform phishing attacks.

The vulnerability is caused by an error when parsing URL. A remote attacker can supply a link with ending "#" character in hostname and cause libcurl client to redirect to a host, specified after the "#" character.

Exploit example:

http://example.com#@evilsite.com/1.txt

The above URL will force libcurl client to connect to evilsite.com hostname instead of example.com.

The vulnerability allows an attacker to perform phishing attacks by tricking victims to connect to untrusted host.


Affected software

libcurl
Amazon Linux AMI
Arch Linux
SUSE Linux
Slackware Linux
Fedora
Opensuse
curl (Alpine package)
curl
Dell EMC Unisphere Central

How to mitigate CVE-2016-8624

The vulnerability is fixed in libcurl 7.51.0:
https://curl.haxx.se/CVE-2016-8625.patch


curl (Alpine package) - update to 7.49.1-r4
Dell EMC Unisphere Central - update to 4.0.8.23220
curl - addressed in versions 7.47.1-9.fc24, 7.51.0-1.fc25

External References

Related Security Bulletins