Stack-based buffer overflow in libcurl - CVE-2019-3822

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The vulnerability exists due to the NT LAN Manager (NTLM) Curl_auth_create_ntlm_type3_message function creates an outgoing NTLM type-3 header and generates the request HTTP header contents based on previously received data. A remote unauthenticated attacker can send very large ‘nt response’ output data, that has been extracted from a previous NTLMv2 header that was provided by a malicious or broken HTTP server, trigger stack-based buffer overflow and cause the service to crash or execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2019-3822

External References

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822
• https://curl.haxx.se/docs/CVE-2019-3822.html

Related Security Bulletins

• Multiple vulnerabilities in libcurl
• Slackware Linux update for curl
• Debian update for curl
• Arch Linux update for lib32-curl
• Arch Linux update for lib32-libcurl-compat
• Arch Linux update for lib32-libcurl-gnutls
• Arch Linux update for libcurl-gnutls
• Arch Linux update for curl
• OpenSUSE Linux update for curl
• OpenSUSE Linux update for curl
• Gentoo update for cURL
• Red Hat update for curl
• Stack-based buffer overflow in curl (Alpine package)
• Amazon Linux AMI update for mysql57
• Multiple vulnerabilities in Dell EMC Unity Family
• Multiple vulnerabilities in Dell EMC Isilon OneFS
• Fedora 29 update for curl
• Multiple vulnerabilities in Oracle Enterprise Manager Ops Center
• Multiple vulnerabilities in MySQL Server
• Multiple vulnerabilities in Services Tools Bundle