Heap-based buffer overflow in cURL - CVE-2019-5436

Vulnerability identifier: #VU18582

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-5436

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing responses from TFTP server in the tftp_receive_packet() function. A remote attacker can trick the victim to send a request to a malicious TFTP server, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

cURL
Gentoo Linux
Arch Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Slackware Linux
Opensuse
Fedora
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
curl (Red Hat package)
curl (Ubuntu package)
curl (Debian package)
gnurl (Alpine package)
curl
Data Computing Appliance (DCA)
Dell PowerProtect Cyber Recovery
IBM Flex System CN4093 10Gb Converged Scalable Switch
IBM RackSwitch G8264CS

Install updates from vendor's website.

cURL - update to 7.65.0
curl (Red Hat package) - addressed in versions 7.29.0-54.el7_7.3, 7.29.0-57.el7, 7.61.1-12.el8
curl (Ubuntu package) - addressed in versions 7.47.0-1ubuntu2.13, 7.58.0-2ubuntu3.7, 7.61.0-1ubuntu2.4, 7.64.0-2ubuntu1.1
curl (Debian package) - update to 7.52.1-5+deb9u10
gnurl (Alpine package) - update to 7.67.0-r0
Data Computing Appliance (DCA) - update to 4.3.0.0
IBM Flex System CN4093 10Gb Converged Scalable Switch - update to 7.8.28.0
IBM RackSwitch G8264CS - update to 7.8.28.0
curl - addressed in versions 7.61.1-11.fc29, 7.64.0-7.fc30
Dell PowerProtect Cyber Recovery - update to 18.1.1.2-8

• https://curl.haxx.se/docs/CVE-2019-5436.html

• Multiple vulnerabilities in cURL
• Ubuntu update for curl
• Slackware Linux update for curl
• Arch Linux update for curl
• Arch Linux update for lib32-curl
• Arch Linux update for lib32-libcurl-compat
• Arch Linux update for lib32-libcurl-gnutls
• Arch Linux update for libcurl-gnutls
• Arch Linux update for libcurl-compat
• OpenSUSE Linux update for curl
• OpenSUSE Linux update for curl
• Amazon Linux AMI update for curl
• Debian update for curl
• Gentoo update for cURL
• Red Hat Enterprise Linux 7 update for curl
• Red Hat Enterprise Linux 8 update for curl
• Red Hat Enterprise Linux 7 update for curl
• Heap-based buffer overflow in gnurl (Alpine package)
• Multiple vulnerabilities in Dell EMC Cyber Recovery
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• IBM Flex System CN4093 10Gb Converged Scalable Switch update for cURL libcurl
• IBM RackSwitch G8264CS update for cURL libcurl
• Fedora 29 update for curl
• Fedora 30 update for curl