PT-2010-5115 · Curl · Curl

Dan Fandrich · Publicado 2010-10-13 · Atualizado 2010-10-28 · CVE-2010-3842

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions curl versions 7.20.0 through 7.21.1

Description The issue allows remote servers to create or overwrite arbitrary files by using a backslash as a separator of path components within the Content-disposition HTTP header when the --remote-header-name or -J option is used. This is possible because curl attempts to cut off directory parts from filenames in the header but did not account for backslashes, which are used as directory separators in some operating systems, including Windows, Netware, MSDOS, OS/2, and Symbian. This could potentially allow a rogue server to overwrite system files, commands, or known executables.

Recommendations For curl versions 7.20.0 through 7.21.1, consider disabling the use of the --remote-header-name or -J option until a patch is available to prevent potential file overwrites. Restrict access to sensitive files and directories to minimize the risk of exploitation. Avoid using the Content-disposition header with backslashes in filenames to prevent potential security issues.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

CWE-30

Identificadores relacionados

CVE-2010-3842

Produtos afetados

Curl

Referências · 9

• https://bugzilla.redhat.com/show_bug.cgi?id=642642 · Nota
• http://curl.haxx.se/docs/adv_20101013.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2010/10/13/1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3842 · Nota de Segurança
• http://openwall.com/lists/oss-security/2010/10/13/4 · Correção
• http://openwall.com/lists/oss-security/2010/10/13/5 · Nota
• http://securitytracker.com/id?1024583 · Nota
• https://osv.dev/vulnerability/CURL-CVE-2010-3842 · Aviso do Fabricante
• http://secunia.com/advisories/39532 · Aviso do Fabricante