PT-2021-21147 · Libfetch+2 · Libfetch+2

Ashish Patil · Published 2021-08-03 · Updated 2024-04-12 · CVE-2021-36159

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions libfetch versions prior to 2021-07-26

Description The issue concerns the mishandling of numeric strings for the FTP and HTTP protocols. Specifically, the FTP passive mode implementation allows an out-of-bounds read due to the use of strtol to parse numbers into address bytes without checking for premature line endings. This results in the for-loop condition checking for the '0' terminator one byte too late.

Recommendations For libfetch versions prior to 2021-07-26, consider updating to a version released after 2021-07-26 to resolve the issue. As a temporary workaround, consider restricting the use of FTP passive mode until a patch is available.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2021-36159

FREEBSD-SA-21_15

Affected Products

Freebsd

Red Os

Libfetch

References · 15

• 🔥 https://gitlab.alpinelinux.org/alpine/apk-tools/-/issues/10749 · Exploit
• https://github.com/freebsd/freebsd-src/commits/main/lib/libfetch · Patch
• https://osv.dev/vulnerability/ALPINE-CVE-2021-36159 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36159 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36159 · Vendor Advisory
• https://t.me/cibsecurity/26745 · Telegram Post
• https://security.alpinelinux.org/vuln/CVE-2021-36159 · Note
• https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E · Note
• https://t.me/cvenotify/20472 · Telegram Post
• https://freebsd.org/security/advisories/FreeBSD-SA-21:15.libfetch.asc · Note
• https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E · Note
• https://t.me/cvenotify/19206 · Telegram Post
• https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E · Note
• https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-etcd-cve-2021-3711-cve-2019-9893-cve-2021-36159-cve-2022-27191 · Note