PT-2013-1239 · Curl · Curl
Volema
·
Publicado
2013-02-06
·
Atualizado
2024-06-15
·
CVE-2013-0249
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
curl versions 7.26.0 through 7.28.1
curl versions prior to 7.34.0
Description
The issue is related to a stack-based buffer overflow in the
Curl sasl create digest md5 message function when negotiating SASL DIGEST-MD5 authentication. This can be exploited by remote attackers via a long string in the realm parameter in POP3, SMTP, or IMAP messages, potentially leading to a denial of service or execution of arbitrary code. The vulnerability can be exploited by someone in control of a server that a libcurl-based program is accessing, or by a malicious user feeding an application with a URL to a server hosting code targeting this flaw. This vulnerability can be used for remote code execution on vulnerable systems.Recommendations
For curl versions 7.26.0 through 7.28.1, update to a version later than 7.28.1.
For curl versions prior to 7.34.0, update to version 7.34.0 or later.
As a temporary workaround, consider restricting access to the
Curl sasl create digest md5 message function until a patch is available.
Avoid using the realm parameter in affected API endpoints until the issue is resolved.Exploit
Correção
Stack Overflow
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Curl