PT-2018-2552 · Curl+6 · Libcurl+6
Wenxiang Qian
·
Publicado
2018-12-30
·
Atualizado
2026-05-18
·
CVE-2019-3822
CVSS v3.1
10
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
libcurl versions 7.36.0 through 7.64.0
MySQL Server versions 5.7.26 and earlier
MySQL Server versions 8.0.15 and earlier
Description
The issue is caused by a stack-based buffer overflow in the function
Curl auth create ntlm type3 message(), which generates the outgoing NTLM type-3 header. This function creates the request HTTP header contents based on previously received data. The check to prevent the local buffer from getting overflowed is implemented wrongly, using unsigned math, and does not prevent the overflow. The output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by a malicious or broken HTTP server. Such large response data needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.Recommendations
For libcurl versions 7.36.0 through 7.64.0, consider disabling the
Curl auth create ntlm type3 message() function until a patch is available.
For MySQL Server versions 5.7.26 and earlier, update to a version later than 5.7.26.
For MySQL Server versions 8.0.15 and earlier, update to a version later than 8.0.15.
As a temporary workaround, restrict access to the NTLMv2 type-2 response header to minimize the risk of exploitation.Exploit
Correção
DoS
Buffer Overflow
Stack Overflow
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Mysql Server
Red Hat
Suse
Ubuntu
Libcurl