CVE-2017-1000257 Information

Description

An IMAP FETCH response line indicates the size of the returned data in number of bytes. When that response says the data is zero bytes libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl’s deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Reference

http://www.debian.org/security/2017/dsa-4007 http://www.securityfocus.com/bid/101519 http://www.securitytracker.com/id/1039644 https://access.redhat.com/errata/RHSA-2017:3263 https://access.redhat.com/errata/RHSA-2018:2486 https://access.redhat.com/errata/RHSA-2018:3558 https://curl.haxx.se/docs/adv_20171023.html https://curl.haxx.se/docs/adv_20171023.html https://security.gentoo.org/glsa/201712-04 An IMAP FETCH response line indicates the size of the returned data in number of bytes. When that response says the data is zero bytes libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl’s deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded. cpe:2.3:a:haxx:libcurl::::::::

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

HIGH

Base Severity

9.1