PT-2010-5115 · Curl · Curl

Dan Fandrich · Published 2010-10-13 · Updated 2010-10-28 · CVE-2010-3842

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions curl versions 7.20.0 through 7.21.1

Description The issue allows remote servers to create or overwrite arbitrary files by using a backslash as a separator of path components within the Content-disposition HTTP header when the --remote-header-name or -J option is used. This is possible because curl attempts to cut off directory parts from filenames in the header but did not account for backslashes, which are used as directory separators in some operating systems, including Windows, Netware, MSDOS, OS/2, and Symbian. This could potentially allow a rogue server to overwrite system files, commands, or known executables.

Recommendations For curl versions 7.20.0 through 7.21.1, consider disabling the use of the --remote-header-name or -J option until a patch is available to prevent potential file overwrites. Restrict access to sensitive files and directories to minimize the risk of exploitation. Avoid using the Content-disposition header with backslashes in filenames to prevent potential security issues.

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-30

Related Identifiers

CVE-2010-3842

Affected Products

Curl

References · 9

• http://curl.haxx.se/docs/adv_20101013.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3842 · Security Note
• http://openwall.com/lists/oss-security/2010/10/13/4 · Patch
• https://osv.dev/vulnerability/CURL-CVE-2010-3842 · Vendor Advisory
• http://secunia.com/advisories/39532 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=642642 · Note
• http://openwall.com/lists/oss-security/2010/10/13/1 · Note
• http://openwall.com/lists/oss-security/2010/10/13/5 · Note
• http://securitytracker.com/id?1024583 · Note