[UNIX] Multiple Vulnerabilities in cURL/libcURL (Kerberos Authentication, NTLM Authentication)

From: SecuriTeam (support_at_securiteam.com)
Date: 03/17/05

  • Next message: SecuriTeam: "[EXPL] phpBB UID Exploit (Perl exploit)" 
    To: list@securiteam.com
Date: 17 Mar 2005 10:24:03 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Multiple Vulnerabilities in cURL/libcURL (Kerberos Authentication, NTLM
    Authentication)
    ------------------------------------------------------------------------

    SUMMARY

     <http://curl.haxx.se/> cURL is "a command line tool for transferring
    files with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET,
    DICT, FILE and LDAP".

    Remote exploitation of a stack-based buffer overflow in various UNIX/Linux
    vendors' implementation of cURL could allow for arbitrary code execution
    on the targeted host.

    DETAILS

    Vulnerable Systems:
     * cURL version 7.3 up to 7.13.0 inclusive

    Immune Systems:
     * cURL version 7.13.1 or newer

    Kerberos Authentication Buffer Overflow:
    An exploitable stack-based buffer overflow condition exists when using
    Kerberos authentication. The problem specifically exists within the
    functions Curl_krb_kauth() and krb4_auth() defined in lib/krb4.c. Within
    these functions a statically allocated stack-based buffer of size 1250,
    from struct KTEXT_ST.dat, is passed to the Curl_base64_decode() routine
    defined in lib/base64.c:

    Code Snips:
        len = Curl_base64_decode(p, (char *)adat.dat);
        tmp = Curl_base64_decode(p, (char *)tkt.dat);

    The Curl_base64_decode() routine relies on the calling function to
    validate the decoded length. This function base64 decodes and copies data
    directly from the HTTP reply of a server to the destination buffer, in
    this case buffer[]. An attacker can construct a long base64 encoded
    malicious payload that upon decoding will overflow the static buffer and
    overwrite the saved EIP. This in turn can lead to arbitrary code
    execution.

     NTLM Authentication Buffer Overflow:
    An exploitable stack-based buffer overflow condition exists when using NT
    Lan Manager (NTLM) authentication. The problem specifically exists within
    Curl_input_ntlm() defined in lib/http_ntlm.c. Within this function an
    unsigned stack-based character array of size 256, buffer[], is passed to
    the Curl_base64_decode() routine defined in lib/base64.c.

    Code Snips:
        size_t size = Curl_base64_decode(header, (char *)buffer);

    The Curl_base64_decode() routine relies on the calling function to
    validate the decoded length. This function base64 decodes and copies data
    directly from the HTTP reply of a server to the destination buffer, in
    this case buffer[]. An attacker can construct a long base64 encoded
    malicious payload that upon decoding will overflow the 256 byte static
    buffer and overwrite the saved EIP. This in turn can lead to arbitrary
    code execution.

    Disclosure Timeline:
    12/21/2004 - Initial vendor notification - No response
    02/10/2005 - Secondary vendor notification - No response
    02/21/2005 - Public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:idlabs-advisories@idefense.com> idlabs.
    The original articles can be found at:
    <http://www.idefense.com/application/poi/display?id=202&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=202&type=vulnerabilities and <http://www.idefense.com/application/poi/display?id=203&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=203&type=vulnerabilities.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] phpBB UID Exploit (Perl exploit)"

    Relevant Pages

    • [NEWS] IBM DB2 Buffer Overflow Vulnerabilities (rec2xml, generate_distfile)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... procedure suffers from a stack based buffer overflow vulnerability. ...
      (Securiteam)
    • [UNIX] Sun Microsystems Solaris ld.so doprf() Buffer Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Sun Microsystems Solaris ld.so 'doprf' Buffer Overflow Vulnerability ...
      (Securiteam)
    • [UNIX] LibSPF2 DNS TXT Record Parsing Bug
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... LibSPF2 DNS TXT Record Parsing Bug ... rdlen byte buffer. ...
      (Securiteam)
    • [EXPL] NetTerms NetFTPd Buffer Overflow (USER, Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Win32 telnet client software - "NetTerm is a network terminal which can ... NetTerm's NetFTPd has a buffer overflow on authentication buffer. ... def setebpaddr: ...
      (Securiteam)
    • [UNIX] Conquest Client Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Conquest Client Buffer Overflow ... SP_CLIENTSTAT is a type of packet used by the server for sending some ...
      (Securiteam)