PT-2012-1100 · Curl+1 · Curl+1

Dan Fandrich · Published 2012-01-24 · Updated 2018-01-10 · CVE-2012-0036

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions curl versions prior to 7.24.0

Description The issue concerns the improper handling of special characters during pathname extraction from URLs, allowing remote attackers to conduct data-injection attacks. This can be exploited through crafted URLs, potentially affecting protocols such as IMAP, POP3, and SMTP. The vulnerability can lead to data injection attacks, including CRLF injection, which may result in unintended actions, such as deleting messages or sending unintended emails.

Recommendations For versions prior to 7.24.0, update to version 7.24.0 or later to resolve the issue. As a temporary workaround, consider restricting user input for URLs to prevent maliciously crafted URLs from being processed. Additionally, restrict access to vulnerable protocols such as IMAP, POP3, and SMTP until the update is applied.

Fix

SQL injection

Weakness Enumeration

CWE-93

CWE-264

CWE-89

Related Identifiers

BDU:2015-09428

CVE-2012-0036

DSA-2398-1

SUSE-SU-2012_0143-1

Affected Products

Suse

Curl

References · 27

• http://mandriva.com/security/advisories?name=MDVSA-2012:058 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-0036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0036 · Security Note
• http://security.gentoo.org/glsa/glsa-201203-02.xml · Vendor Advisory
• http://debian.org/security/2012/dsa-2398 · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-0036 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-0036 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2012/May/msg00001.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09428 · Security Note
• http://curl.haxx.se/curl-url-sanitize.patch · Patch
• https://osv.dev/vulnerability/CURL-CVE-2012-0036 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0036 · Security Note
• http://curl.haxx.se/docs/adv_20120124.html · Vendor Advisory
• https://github.com/bagder/curl/commit/75ca568fa1c19de4c5358fed246686de8467c238 · Note