[UNKNOWN] curl
At a glance
- Source
- NVD
- EPSS
- EPSS 11.12 % · percentile 96 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)
Weaknesses (CWE)
- CWE-131 — Incorrect Calculation of Buffer Size
- CWE-122 — Heap-based Buffer Overflow
- CWE-190 — Integer Overflow or Wraparound
References
- https://curl.haxx.se/docs/CVE-2018-14618.html
- https://security.gentoo.org/glsa/201903-03
- https://usn.ubuntu.com/3765-1/
- https://access.redhat.com/errata/RHSA-2018:3558
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0014
- https://www.debian.org/security/2018/dsa-4286
- http://www.securitytracker.com/id/1041605
- https://usn.ubuntu.com/3765-2/
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14618
- https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf
- https://access.redhat.com/errata/RHSA-2019:1880
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | redhat |
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.0 | CRITICAL 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2018-6525
- GCVE · GCVE-0-2018-14618
CERT-FR advisories
- CERTFR-2019-AVI-151 — SCADA Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2018-AVI-589 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:*< 7.61.1cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| [UNKNOWN] · curl | affected 7.61.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |