Heap out-of-bounds read in libcurl - CVE-2018-16890

Detailed vulnerability description

The vulnerability allows a remote attacker to gain access to potentially sensitive information or cause the service to crash.

The vulnerability exists due to a integer overflow in the function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly. A remote attacker on malicious or broken NTLM server can trick the victim into accepting a bad length + offset combination, trigger heap out-of-bounds read error and read contents of memory on the system or cause the service to crash..

How to mitigate CVE-2018-16890

Sources

• http://www.securityfocus.com/bid/106947
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16890
• https://curl.haxx.se/docs/CVE-2018-16890.html
• https://usn.ubuntu.com/3882-1/
• https://www.debian.org/security/2019/dsa-4386