Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities:

  - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is     enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary     requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3)     execute arbitrary commands via a redirect to an scp: URL. (CVE-2009-0037)

  - The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl     and other products, always performs credential delegation during GSSAPI authentication, which allows     remote servers to impersonate clients via GSSAPI requests. (CVE-2011-2192)

  - curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a     pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as     demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol. (CVE-2012-0036)

  - Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl     and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in     the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message. (CVE-2013-0249)

  - The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path     domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the     domain of a URL. (CVE-2013-1944)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - curl version curl 7.20.0 to and including curl 7.59.0     contains a CWE-126: Buffer Over-read vulnerability in     denial of service that can result in curl can be     tricked into reading data beyond the end of a heap     based buffer used to store downloaded RTSP     content..(CVE-2018-1000301)

  - It was found that the libcurl library did not check the     client certificate when choosing the TLS connection to     reuse. An attacker could potentially use this flaw to     hijack the authentication of the connection by     leveraging a previously created connection with a     different client certificate.(CVE-2016-5420)

  - It was discovered that libcurl could incorrectly reuse     NTLM-authenticated connections for subsequent     unauthenticated requests to the same host. If an     application using libcurl established an     NTLM-authenticated connection to a server, and sent     subsequent unauthenticated requests to the same server,     the unauthenticated requests could be sent over the     NTLM-authenticated connection, appearing as if they     were sent by the NTLM authenticated     user.(CVE-2015-3143)

  - libcurl may read outside of a heap allocated buffer     when doing FTP. When libcurl connects to an FTP server     and successfully logs in (anonymous or not), it asks     the server for the current directory with the `PWD`     command. The server then responds with a 257 response     containing the path, inside double quotes. The returned     path name is then kept by libcurl for subsequent uses.
    Due to a flaw in the string parser for this directory     name, a directory name passed like this but without a     closing double quote would lead to libcurl not adding a     trailing NUL byte to the buffer holding the name. When     libcurl would then later access the string, it could     read beyond the allocated heap buffer and crash or     wrongly access data beyond the buffer, thinking it was     part of the path. A malicious server could abuse this     fact and effectively prevent libcurl-based clients to     work with it - the PWD command is always issued on new     FTP connections and the mistake has a high chance of     causing a segfault. The simple fact that this has issue     remained undiscovered for this long could suggest that     malformed PWD responses are rare in benign servers. We     are not aware of any exploit of this flaw. This bug was     introduced in commit     415d2e7cb7(https://github.com/curl/curl/commit/415d2e7c     b7), March 2005. In libcurl version 7.56.0, the parser     always zero terminates the string but also rejects it     if not terminated properly with a final double     quote.(CVE-2017-1000254)

  - It was discovered that libcurl could incorrectly reuse     Negotiate authenticated HTTP connections for subsequent     requests. If an application using libcurl established a     Negotiate authenticated HTTP connection to a server and     sent subsequent requests with different credentials,     the connection could be re-used with the initial set of     credentials instead of using the new     ones.(CVE-2015-3148)

  - Heap-based buffer overflow in the curl_easy_unescape     function in lib/escape.c in cURL and libcurl 7.7     through 7.30.0 allows remote attackers to cause a     denial of service (application crash) or possibly     execute arbitrary code via a crafted string ending in a     ''%'' (percent) character.(CVE-2013-2174)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8616)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8619)

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external     entities.(CVE-2018-1000007)

  - A flaw was found in the way the libcurl library     performed the duplication of connection handles. If an     application set the CURLOPT_COPYPOSTFIELDS option for a     handle, using the handle's duplicate could cause the     application to crash or disclose a portion of its     memory.(CVE-2014-3707)

  - Multiple integer overflow flaws leading to heap-based     buffer overflows were found in the way curl handled     escaping and unescaping of data. An attacker could     potentially use these flaws to crash an application     using libcurl by sending a specially crafted input to     the affected libcurl functions.(CVE-2016-7167)

  - When doing a TFTP transfer and curl/libcurl is given a     URL that contains a very long file name (longer than     about 515 bytes), the file name is truncated to fit     within the buffer boundaries, but the buffer size is     still wrongly updated to use the untruncated length.
    This too large value is then used in the sendto() call,     making curl attempt to send more data than what is     actually put into the buffer. The endto() function will     then read beyond the end of the heap based buffer. A     malicious HTTP(S) server could redirect a vulnerable     libcurl-using client to a crafted TFTP URL (if the     client hasn't restricted which protocols it allows     redirects to) and trick it to send private memory     contents to a remote server over UDP. Limit curl's     redirect protocols with --proto-redir and libcurl's     with CURLOPT_REDIR_PROTOCOLS.(CVE-2017-1000100)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix heap-based buffer overflow in curl_easy_unescape     (CVE-2013-2174)

  - fix cookie tailmatching to prevent cross-domain leakage     (CVE-2013-1944)

  - introduce the --delegation option of curl (#746849)

  - fix stack smashing in the FTP implementation (#652557)

  - fix proxy kerberos authentication (#657396)

  - update running_handles counter properly in     curl_multi_remove_handle (#688871)

  - add a new option CURLOPT_GSSAPI_DELEGATION (#723643)

  - do not delegate GSSAPI credentials (CVE-2011-2192)

  - avoid use of uninitialized variable on failure of a LDAP     request (#655073)

  - proxy tunnel support for LDAP requests (#655073)

The remote Solaris system is missing necessary patches to address security updates :

  - The tailMatch function in cookie.c in cURL and libcurl     before 7.30.0 does not properly match the path domain     when sending cookies, which allows remote attackers to     steal cookies via a matching suffix in the domain of a     URL. (CVE-2013-1944)

  - Heap-based buffer overflow in the curl_easy_unescape     function in lib/escape.c in cURL and libcurl 7.7 through     7.30.0 allows remote attackers to cause a denial of     service (application crash) or possibly execute     arbitrary code via a crafted string ending in a '%'     (percent) character. (CVE-2013-2174)

  - cURL and libcurl 7.18.0 through 7.32.0, when built with     OpenSSL, disables the certificate CN and SAN name field     verification (CURLOPT_SSL_VERIFYHOST) when the digital     signature verification (CURLOPT_SSL_VERIFYPEER) is     disabled, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid certificate.
    (CVE-2013-4545)

  - cURL and libcurl 7.10.6 through 7.34.0, when more than     one authentication method is enabled, re-uses NTLM     connections, which might allow context-dependent     attackers to authenticate as other users via a request.
    (CVE-2014-0015)

A vulnerability was discovered for the curl and libcurl packages in openSUSE versions 12.2 and 12.3.

The remote host is affected by the vulnerability described in GLSA-201401-14 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user or automated process to connect to       a malicious server using cURL, possibly resulting in the remote execution       of arbitrary code or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

CVE-2013-2174 - fix heap-based buffer overflow in curl_easy_unescape()

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of curl fixes a security issue in libcurl URL buffer decoding. (bnc#824517 / CVE-2013-2174)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0983 advisory.

    [7.19.7-37]
    - fix heap-based buffer overflow in curl_easy_unescape() (CVE-2013-2174)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update of curl fixes several security issues.

  - libcurl URL decode buffer boundary flaw (bnc#824517 /     CVE-2013-2174)

This update of curl fixes several security issues :

  - libcurl URL decode buffer boundary flaw. (bnc#824517 /     CVE-2013-2174)

  - cookie domain tailmatch. (bnc#814655 / CVE-2013-1944)

  - curl sets SSL_OP_ALL. (bnc#742306 / CVE-2011-3389)

  - When SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled,     does not properly prevent modification of the     ciphersuite in the session cache, which allows remote     attackers to force the downgrade to an unintended cipher     via vectors involving sniffing network traffic to     discover a session identifier. (CVE-2010-4180)

This update of compat-curl2 fixes a security vulnerability :

  - libcurl URL decode buffer boundary flaw (bnc#824517 /     CVE-2013-2174)

This update of curl fixes several security issues :

  - libcurl URL decode buffer boundary flaw (bnc#824517 /     CVE-2013-2174)

Timo Sirainen discovered that libcurl incorrectly handled memory when parsing URL encoded strings. An attacker could possibly use this issue to cause libcurl to crash, leading to a denial of service, or execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A heap-based buffer overflow flaw was found in the way libcurl unescaped URLs. A remote attacker could provide a specially-crafted URL that, when processed by an application using libcurl that handles untrusted URLs, would possibly cause it to crash or, potentially, execute arbitrary code. (CVE-2013-2174)

A heap-based buffer overflow flaw was found in the way libcurl unescaped URLs. A remote attacker could provide a specially-crafted URL that, when processed by an application using libcurl that handles untrusted URLs, would possibly cause it to crash or, potentially, execute arbitrary code.

A vulnerability has been discovered and corrected in curl :

libcurl is vulnerable to a case of bad checking of the input data which may lead to heap corruption. The function curl_easy_unescape() decodes URL encoded strings to raw binary data. URL encoded octets are represented with \%HH combinations where HH is a two-digit hexadecimal number. The decoded string is written to an allocated memory area that the function returns to the caller (CVE-2013-2174).

The updated packages have been patched to correct this issue.

Updated curl packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

cURL provides the libcurl library and a command line tool for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

A heap-based buffer overflow flaw was found in the way libcurl unescaped URLs. A remote attacker could provide a specially crafted URL that, when processed by an application using libcurl that handles untrusted URLs, would possibly cause it to crash or, potentially, execute arbitrary code. (CVE-2013-2174)

Red Hat would like to thank the cURL project for reporting this issue.
Upstream acknowledges Timo Sirainen as the original reporter.

Users of curl should upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications using libcurl must be restarted for the update to take effect.

A heap-based buffer overflow flaw was found in the way libcurl unescaped URLs. A remote attacker could provide a specially crafted URL that, when processed by an application using libcurl that handles untrusted URLs, would possibly cause it to crash or, potentially, execute arbitrary code. (CVE-2013-2174)

All running applications using libcurl must be restarted for the update to take effect.

Timo Sirainen discovered that cURL, an URL transfer library, is prone to a heap overflow vulnerability due to bad checking of the input data in the curl_easy_unescape function.

The curl command line tool is not affected by this problem as it doesn't use the curl_easy_unescape function.

cURL developers report :

libcurl is vulnerable to a case of bad checking of the input data which may lead to heap corruption.

The function curl_easy_unescape() decodes URL-encoded strings to raw binary data. URL-encoded octets are represented with %HH combinations where HH is a two-digit hexadecimal number. The decoded string is written to an allocated memory area that the function returns to the caller.

The function takes a source string and a length parameter, and if the length provided is 0 the function will instead use strlen() to figure out how much data to parse.

The '%HH' parser wrongly only considered the case where a zero byte would terminate the input. If a length-limited buffer was passed in which ended with a '%' character which was followed by two hexadecimal digits outside of the buffer libcurl was allowed to parse alas without a terminating zero, libcurl would still parse that sequence as well.
The counter for remaining data to handle would then be decreased too much and wrap to become a very large integer and the copying would go on too long and the destination buffer that is allocated on the heap would get overwritten.

We consider it unlikely that programs allow user-provided strings unfiltered into this function. Also, only the not zero-terminated input string use case is affected by this flaw. Exploiting this flaw for gain is probably possible for specific circumstances but we consider the general risk for this to be low.

The curl command line tool is not affected by this problem as it doesn't use this function.

There are no known exploits available at this time.

New curl packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix a security issue.

ID	Name	Product	Family	Severity
206854	NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)	Nessus	NewStart CGSL Local Security Checks	critical
125003	EulerOS Virtualization 3.0.1.0 : curl (EulerOS-SA-2019-1550)	Nessus	Huawei Local Security Checks	critical
91740	OracleVM 3.2 : curl (OVMSA-2016-0056)	Nessus	OracleVM Local Security Checks	medium
80662	Oracle Solaris Third-Party Patch Update : libcurl (cve_2013_1944_information_disclosure)	Nessus	Solaris Local Security Checks	medium
75070	openSUSE Security Update : curl / libcurl (openSUSE-SU-2013:1132-1)	Nessus	SuSE Local Security Checks	medium
72053	GLSA-201401-14 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
68998	Fedora 17 : curl-7.24.0-10.fc17 (2013-11568)	Nessus	Fedora Local Security Checks	medium
68948	SuSE 11.3 Security Update : curl (SAT Patch Number 7932)	Nessus	SuSE Local Security Checks	medium
68841	Oracle Linux 5 / 6 : curl (ELSA-2013-0983)	Nessus	Oracle Linux Local Security Checks	critical
67313	Fedora 18 : curl-7.27.0-11.fc18 (2013-11574)	Nessus	Fedora Local Security Checks	medium
67312	Fedora 19 : curl-7.29.0-7.fc19 (2013-11521)	Nessus	Fedora Local Security Checks	medium
67242	SuSE 10 Security Update : curl (ZYPP Patch Number 8614)	Nessus	SuSE Local Security Checks	medium
67223	SuSE 10 Security Update : libcurl4 (ZYPP Patch Number 8618) (BEAST)	Nessus	SuSE Local Security Checks	medium
67222	SuSE 10 Security Update : compat-curl2 (ZYPP Patch Number 8621)	Nessus	SuSE Local Security Checks	medium
67221	SuSE 11.2 Security Update : curl (SAT Patch Number 7867)	Nessus	SuSE Local Security Checks	medium
67138	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : curl vulnerability (USN-1894-1)	Nessus	Ubuntu Local Security Checks	medium
801395	cURL/libcURL 'curl_easy_unescape()' Heap Memory Corruption Vulnerability	Log Correlation Engine	Web Clients	medium
6898	cURL/libcURL 'curl_easy_unescape()' Heap Memory Corruption	Nessus Network Monitor	Web Clients	medium
67010	Mandriva Linux Security Advisory : curl (MDVSA-2013:180)	Nessus	Mandriva Local Security Checks	medium
66998	CentOS 5 / 6 : curl (CESA-2013:0983)	Nessus	CentOS Local Security Checks	medium
66982	Scientific Linux Security Update : curl on SL5.x, SL6.x i386/srpm/x86_64 (20130625)	Nessus	Scientific Linux Local Security Checks	medium
66981	RHEL 5 / 6 : curl (RHSA-2013:0983)	Nessus	Red Hat Local Security Checks	medium
66974	Debian DSA-2713-1 : curl - heap overflow	Nessus	Debian Local Security Checks	medium
66968	FreeBSD : cURL library -- heap corruption in curl_easy_unescape (01cf67b3-dc3b-11e2-a6cd-c48508086173)	Nessus	FreeBSD Local Security Checks	medium
66967	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : curl (SSA:2013-174-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2013-2174

critical

Tenable Plugins

critical

critical

medium

medium

medium

high

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium