Heap-based buffer over-read in cURL - CVE-2018-1000301

Vulnerability identifier: #VU12800

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1000301

CWE-ID: CWE-126

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information and cause DoS condition on the target system.

The weakness exists due to heap-based buffer over-read. When servers send RTSP responses back to curl, the data starts out with a set of headers. curl parses that data to separate it into a number of headers to deal with those appropriately and to find the end of the headers that signal the start of the "body" part. The function that splits up the response into headers is called Curl_http_readwrite_headers() and in situations where it can't find a single header in the buffer, it might end up leaving a pointer pointing into the buffer instead of to the start of the buffer which then later on may lead to an out of buffer read when code assumes that pointer points to a full buffer size worth of memory to use. A remote attacker can gain access to potentially sensitive information and cause the service to crash.

cURL

Debian Linux
Arch Linux
Gentoo Linux
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
Slackware Linux
Fedora
curl (Alpine package)
openSUSE Leap
curl
System x Integrated Management Module (IMM2)
Flex System Integrated Management Module (IMM2)
Flex System Chassis Management Module (CMM)
Integrated Management Module II (IMM2) for BladeCenter Systems
Dell EMC Unisphere Central

Update to version 7.60.0.

curl (Alpine package) - update to 7.60.0-r0
System x Integrated Management Module (IMM2) - update to 1AOO86D-7.00
Flex System Integrated Management Module (IMM2) - update to 1AOO86D-7.00
Integrated Management Module II (IMM2) for BladeCenter Systems - update to 1AOO86D-7.00-bc
Flex System Chassis Management Module (CMM) - update to 2pet16d-2.5.13d
Dell EMC Unisphere Central - update to 4.0.8.23220
curl - addressed in versions 7.55.1-11.fc27, 7.59.0-3.fc28

• https://curl.haxx.se/docs/adv_2018-b138.html

• Slackware Linux update for curl
• Debian update for curl
• Arch Linux update for libcurl-gnutls
• Arch Linux update for curl
• Arch Linux update for lib32-curl
• Arch Linux update for lib32-libcurl-compat
• Arch Linux update for libcurl-compat
• Arch Linux update for lib32-libcurl-gnutls
• OpenSUSE Linux update for curl
• OpenSUSE Linux update for curl
• Gentoo update for cURL
• Red Hat update for curl and nss-pem
• Red Hat update for curl
• Red Hat Enterprise Linux Server 7.4 update for curl
• Heap-based buffer over-read in curl (Alpine package)
• Multiple vulnerabilities in Dell EMC Unisphere Central
• Multiple vulnerabilities in IBM Integrated Management Module II (IMM2)
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
• Fedora 27 update for curl
• Fedora 28 update for curl